# CVE-2026-67425: Flytohub Flyto2 Core API key leakage via caller-controlled base_url

Source: https://junglewise.ai/threats/cve-2026-67425-flytohub-flyto2-core-api-key-leakage-via-caller-controlled-base  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-29. Updated: 2026-07-30  
License: CC BY 4.0 with a link back

CVE-2026-67425 · Severity: high · CVSS 8.6 · Published 2026-07-29

A vulnerability in Flyto2 Core allows sensitive API keys for AI services (like OpenAI or Anthropic) to be leaked to unauthorized parties. By providing a custom web address, an attacker can trick the system into sending the administrator's private credentials to a server they control. This could lead to unauthorized usage of AI services, data exposure, and significant financial costs for the account owner.

Technologies: [flyto-core (PyPI)](https://junglewise.ai/threats/technologies/flyto-core). Vendors: [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2026-67425 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-67425 being exploited in the wild.

**How severe is CVE-2026-67425?** High severity, with a CVSS score of 8.6, published 29 July 2026.

**Which products and versions are affected?** flyto-core (PyPI) < 2.26.7, ECOSYSTEM:introduced=0,fixed=2.26.7.

**Is there a fix for CVE-2026-67425?** Yes. flyto-core (PyPI): upgrade to 2.26.7 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-67425 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-67425?** Check whether you run flyto-core (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- flyto-core (PyPI): upgrade to 2.26.7 or later

  ```sh
  pip install "flyto-core>=2.26.7"
  ```


## Technical details

A credential leakage vulnerability exists in Flyto2 Core's LLM and vector database modules, including llm.chat, ai.model, and vector.connector. The application retrieves provider API keys (e.g., OPENAI_API_KEY) from environment variables and automatically attaches them to the 'Authorization' header of outgoing requests. Because the 'base_url' parameter is caller-controlled and only validated against a basic SSRF guard that permits public hosts, an attacker can specify a malicious endpoint to capture the operator's secrets. This occurs because the system fails to verify if the destination host is a trusted provider before attaching sensitive credentials. The issue is fixed in version 2.26.7.

## Affected products

- flytohub flyto-core < 2.26.7

## Identifiers

- CVE-2026-67425
- GHSA-qq9q-xgm3-xv9g
- PYSEC-2026-3573

## Timeline

- 2026-07-07: disclosed
- 2026-07-29: advisory: NVD publication
- 2026-07-30: patched: GitHub Advisory published and reviewed

## References

- [https://api.github.com/users/kaimandalic](https://api.github.com/users/kaimandalic)
- [https://github.com/kaimandalic](https://github.com/kaimandalic)
- [https://api.github.com/users/kaimandalic/gists%7B/gist_id%7D](https://api.github.com/users/kaimandalic/gists%7B/gist_id%7D)
- [https://api.github.com/users/kaimandalic/repos](https://api.github.com/users/kaimandalic/repos)
- [https://avatars.githubusercontent.com/u/204785446?v=4](https://avatars.githubusercontent.com/u/204785446?v=4)
- [https://api.github.com/users/kaimandalic/events%7B/privacy%7D](https://api.github.com/users/kaimandalic/events%7B/privacy%7D)

## Related threats

- [flytohub flyto-core SSRF bypass via IPv6 transition addresses](https://junglewise.ai/threats/cve-2026-55787-flytohub-flyto-core-ssrf-bypass-via-ipv6-transition-addresses)
- [flytohub flyto-core unauthenticated command execution in HTTP MCP](https://junglewise.ai/threats/cve-2026-55786-flytohub-flyto-core-unauthenticated-command-execution-in-http-mcp)
- [Flytohub Flyto2 Core path traversal in file-writing modules](https://junglewise.ai/threats/cve-2026-67429-flytohub-flyto2-core-path-traversal-in-file-writing-modules)
- [Flyto2 Core SSRF in multiple HTTP-emitting modules](https://junglewise.ai/threats/cve-2026-67428-flyto2-core-ssrf-in-multiple-http-emitting-modules)
- [Flyto2 Core environment variable interpolation policy bypass](https://junglewise.ai/threats/cve-2026-67427-flyto2-core-environment-variable-interpolation-policy-bypass)