Executive brief
Flyto2 Core, a framework for building AI workflows, contains a security flaw where several of its communication modules fail to verify the destination of web requests. An authorized user could exploit this to force the system to connect to internal servers or cloud management interfaces that should be private. This could lead to the theft of sensitive cloud credentials or unauthorized access to internal company data and services.
Technical details
A Server-Side Request Forgery (SSRF) vulnerability exists in multiple Flyto2 Core modules, including core.api.http_get, graphql.query, and various notification handlers. While the project includes an SSRF guard (validate_url_with_env_config), these specific modules bypass it, relying instead on an inert metadata tag. An authenticated attacker with workflow-author privileges can provide a malicious URL (e.g., 169.254.169.254 or 127.0.0.1) to the affected modules. Because the full response body is returned to the caller, this enables the theft of IAM credentials from cloud metadata services and read/write access to internal APIs. The issue is fixed in version 2.26.7.
Affected products
- flytohub flyto-core <= 2.26.6
Timeline
- 2026-07-08: disclosed
- 2026-07-29: advisory: NVD publication
- 2026-07-30: patched: GitHub Advisory published/updated with patch version 2.26.7