Is CVE-2026-67426 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-67426 being exploited in the wild.

How severe is CVE-2026-67426?

Critical severity, with a CVSS score of 9.3, published 29 July 2026.

Which products and versions are affected?

flyto-core (PyPI) <= 2.26.6, ECOSYSTEM:introduced=0,fixed=2.26.7, ECOSYSTEM:introduced=2.26.6,fixed=2.26.7.

Is there a fix for CVE-2026-67426?

Yes. flyto-core (PyPI): upgrade to 2.26.7 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-67426 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-67426?

Check whether you run flyto-core (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-67426: Flyto2 Core SSRF and secret exfiltration in verification service

Q: Which products and versions are affected?

flyto-core (PyPI) <= 2.26.6, ECOSYSTEM:introduced=0,fixed=2.26.7, ECOSYSTEM:introduced=2.26.6,fixed=2.26.7.

Q: Is there a fix for CVE-2026-67426?

Yes. flyto-core (PyPI): upgrade to 2.26.7 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-67426 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-67426?

Check whether you run flyto-core (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-67426 · Severity: critical · CVSS 9.3 · Published 2026-07-29

The Flyto2 Core verification service contains a security flaw that allows unauthorized users to trigger network requests from the server. This can be used to access sensitive internal data or steal secret keys used to authenticate with other parts of the system. An attacker could use these stolen keys to impersonate legitimate services, potentially leading to a full system compromise.

Technologies: flyto-core (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2026-67426 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-67426 being exploited in the wild.
How severe is CVE-2026-67426?: Critical severity, with a CVSS score of 9.3, published 29 July 2026.
Which products and versions are affected?: flyto-core (PyPI) <= 2.26.6, ECOSYSTEM:introduced=0,fixed=2.26.7, ECOSYSTEM:introduced=2.26.6,fixed=2.26.7.
Is there a fix for CVE-2026-67426?: Yes. flyto-core (PyPI): upgrade to 2.26.7 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-67426 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-67426?: Check whether you run flyto-core (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

flyto-core (PyPI): upgrade to 2.26.7 or later
```
pip install "flyto-core>=2.26.7"
```

Technical details

The flyto-verification service exposes a POST /run endpoint without authentication. The 'callback_url' parameter in the request body is used verbatim in an outbound POST request without being validated against an allowlist or SSRF guard. Crucially, the service unconditionally attaches the 'X-Internal-Key' header containing the $FLYTO_RUNNER_SECRET to this outbound request. This allows an unauthenticated remote attacker to exfiltrate the runner secret to an external server or perform SSRF against internal metadata endpoints with a controlled JSON body. The vulnerability is present in versions up to 2.26.6 and is fixed in 2.26.7.

Affected products

flytohub flyto-core <= 2.26.6

Identifiers

CVE-2026-67426
GHSA-jx74-cqjv-2c67
PYSEC-2026-3571

Timeline

2026-07-29: disclosed
2026-07-30: advisory
2026-07-30: patched: Fixed in version 2.26.7

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.