Executive brief
The Flyto2 Core verification service contains a security flaw that allows unauthorized users to trigger network requests from the server. This can be used to access sensitive internal data or steal secret keys used to authenticate with other parts of the system. An attacker could use these stolen keys to impersonate legitimate services, potentially leading to a full system compromise.
Technical details
The flyto-verification service exposes a POST /run endpoint without authentication. The 'callback_url' parameter in the request body is used verbatim in an outbound POST request without being validated against an allowlist or SSRF guard. Crucially, the service unconditionally attaches the 'X-Internal-Key' header containing the $FLYTO_RUNNER_SECRET to this outbound request. This allows an unauthenticated remote attacker to exfiltrate the runner secret to an external server or perform SSRF against internal metadata endpoints with a controlled JSON body. The vulnerability is present in versions up to 2.26.6 and is fixed in 2.26.7.
Affected products
- flytohub flyto-core <= 2.26.6
Timeline
- 2026-07-29: disclosed
- 2026-07-30: advisory
- 2026-07-30: patched: Fixed in version 2.26.7