flytohub vulnerabilities

Products

• flyto-core 9

Latest flytohub CVEs

Newest publication first

1. CVE-2026-55786 Flyto2 Core: Unauthenticated Command Execution via HTTP MCP `execute_module`

   Published 2026-10-14

   High·CVSS 8.4 EPSS 0.41%

   Flyto2 Core is an execution kernel for automation and AI-agent workflows. From 2.26.2 until 2.26.4, the HTTP MCP POST /mcp route accepts unauthenticated JSON-RPC tools/call requests and forwards execute_module arguments to the module registry without the require_auth dependency u...

2. CVE-2026-55787 Flyto2 Core: SSRF guard bypass via IPv6 transition addresses (IPv4-mapped / 6to4 / NAT64) in validate_url_ssrf

   Published 2026-10-14

   High·CVSS 7.1 EPSS 0.29%

   Flyto2 Core is an execution kernel for automation and AI-agent workflows. Prior to 2.26.3, validate_url_ssrf and is_private_ip in src/core/utils.py compare resolved addresses only against native private IPv4 and IPv6 ranges and do not unwrap IPv4-mapped, IPv4-compatible, 6to4, or...

3. CVE-2026-73530 Flyto2 Core < 2.28.0 SSRF Guard Bypass via is_private_ip()

   Published 2026-08-13

   Medium·CVSS 6.3 EPSS 0.43%

   Flyto2 Core before 2.28.0 contains a server-side request forgery guard bypass vulnerability that allows attackers to reach internal services by supplying URLs using the unblocked IPv6 address :: which the kernel routes to loopback identically to 0.0.0.0. Attackers can submit requ...

4. CVE-2026-67429 Flyto2 Core: Arbitrary file write via image.download (and other file-writing modules)

   Published 2026-07-29

   Critical·CVSS 10.0 EPSS 0.58%

   Flyto2 Core is an execution kernel for automation and AI-agent workflows. Prior to 2.26.6, image.download and related file-writing modules use caller-controlled output_dir instead of validate_path_with_env_config and its FLYTO_SANDBOX_DIR confinement, allowing attacker-controlled...

5. CVE-2026-67428 Flyto2 Core: Multiple HTTP-family modules fetch client-controlled URLs without the SSRF guard their siblings apply (SSRF to internal/metadata)

   Published 2026-07-29

   High·CVSS 8.5 EPSS 0.41%

   Flyto2 Core is an execution kernel for automation and AI-agent workflows. Prior to 2.26.7, HTTP-emitting modules including src/core/modules/third_party/developer/http/requests.py, core.api.http_get, core.api.http_post, graphql.query, graphql.mutation, monitor.http_check, communic...

6. CVE-2026-67427 Flyto2 Core: ${env.VAR} interpolation reads any env secret despite env.get being denylisted

   Published 2026-07-29

   High·CVSS 8.6 EPSS 0.45%

   Flyto2 Core is an execution kernel for automation and AI-agent workflows. Prior to 2.26.6, the workflow engine variable resolver expands ${env.VAR} for any host environment variable without an allowlist or capability policy check, allowing a workflow parameter to bypass the defau...

7. CVE-2026-67426 Flyto2 Core: Unauthenticated flyto-verification /run: callback_url SSRF and internal runner-secret exfiltration

   Published 2026-07-29

   Critical·CVSS 9.3 EPSS 0.37%

   Flyto2 Core is an execution kernel for automation and AI-agent workflows. Prior to 2.26.7, the standalone flyto-verification service in src/core/verification_service.py exposes unauthenticated POST /run on 0.0.0.0:8344 and uses client-supplied callback_url for an outbound POST wi...

8. CVE-2026-67425 Flyto2 Core: LLM/API keys leak to an attacker-controlled base_url

   Published 2026-07-29

   High·CVSS 8.6 EPSS 0.41%

   Flyto2 Core is an execution kernel for automation and AI-agent workflows. Prior to 2.26.6, llm.chat reads provider keys such as OPENAI_API_KEY and ANTHROPIC_API_KEY from the environment and sends them in the Authorization: Bearer header to caller-controlled base_url, allowing an...

9. CVE-2026-67424 Flyto2 Core: Guarded HTTP modules follow redirects into internal space without per-hop SSRF revalidation

   Published 2026-07-29

   High·CVSS 8.5 EPSS 0.29%

   Flyto2 Core is an execution kernel for automation and AI-agent workflows. Prior to 2.26.7, the HTTP modules http.get, http.request, and http.batch in src/core/modules/atomic/http/get.py, src/core/modules/atomic/http/request.py, and src/core/modules/atomic/http/batch.py validate o...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.