Executive brief
Flyto2 Core, a workflow engine, contains a security bypass that allows unauthorized access to sensitive server information. While the system is designed to block direct access to environment variables like API keys and database credentials, an attacker can use a specific text format to trick the engine into revealing these secrets. This could lead to the theft of cloud access keys or other critical credentials, potentially allowing further attacks on the organization's infrastructure.
Technical details
A vulnerability in Flyto2 Core's workflow engine allows for the exfiltration of host environment variables. While the `env.get` and `env.load_dotenv` modules are denylisted by default to prevent secret exfiltration, the `VariableResolver` in `src/core/engine/variable_resolver.py` performs `${env.VAR}` interpolation without checking the module policy or an allowlist. An attacker can trigger this via the workflow API or MCP agent surface by providing parameters containing the interpolation syntax. The resolved secrets can then be exfiltrated through any allowed outbound module. This issue is patched in version 2.26.7.
Affected products
- flytohub flyto-core < 2.26.7
Timeline
- 2026-07-07: disclosed: Initial report by kaimandalic
- 2026-07-29: advisory: NVD publication date
- 2026-07-30: patched: GitHub Advisory published and version 2.26.7 released