{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","feed_url":"https://feed.craftedsignal.io/vendors/flyto/feed.json","home_page_url":"https://feed.craftedsignal.io/","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"cvss":8.6,"id":"CVE-2026-67425"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["flyto-core (\u003c 2.26.7)"],"_cs_severities":["high"],"_cs_tags":["credential-theft","vulnerability","cloud-security","cve-2026-67425","cve-2026-67427","exfiltration","flyto","variable-interpolation"],"_cs_type":"advisory","_cs_vendors":["Flyto"],"content_html":"\u003cp\u003eFlyto-core is susceptible to a credential exfiltration vulnerability (CVE-2026-67425) affecting multiple modules including \u003ccode\u003ellm.chat\u003c/code\u003e, \u003ccode\u003eai.model\u003c/code\u003e, \u003ccode\u003ellm.agent\u003c/code\u003e, and \u003ccode\u003evector.connector\u003c/code\u003e. The vulnerability exists because the library automatically fetches sensitive environment variables, such as \u003ccode\u003eOPENAI_API_KEY\u003c/code\u003e or \u003ccode\u003eQDRANT_API_KEY\u003c/code\u003e, and appends them as \u003ccode\u003eAuthorization: Bearer\u003c/code\u003e headers to outgoing HTTP requests. While the library implements an SSRF guard, this mechanism only validates that the target host is not private; it does not prevent the application from sending requests to public, attacker-controlled servers. An attacker capable of influencing the \u003ccode\u003ebase_url\u003c/code\u003e parameter via the MCP agent surface or hosted API can redirect these requests to an arbitrary public endpoint, successfully capturing the operator's environment-stored credentials. This vulnerability affects all \u003ccode\u003eflyto-core\u003c/code\u003e versions prior to 2.26.7 and can result in significant financial and data impact through unauthorized account usage.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker identifies an exposed application interface that interacts with \u003ccode\u003eflyto-core\u003c/code\u003e and allows user-supplied parameters.\u003c/li\u003e\n\u003cli\u003eAttacker crafts a payload specifically targeting the \u003ccode\u003ebase_url\u003c/code\u003e parameter within the library's \u003ccode\u003ellm.chat\u003c/code\u003e or \u003ccode\u003eai.model\u003c/code\u003e functions.\u003c/li\u003e\n\u003cli\u003eAttacker points \u003ccode\u003ebase_url\u003c/code\u003e to a custom-controlled public web server capable of capturing inbound HTTP headers.\u003c/li\u003e\n\u003cli\u003eThe victim application receives the malicious request and passes the \u003ccode\u003ebase_url\u003c/code\u003e parameter to the vulnerable library functions.\u003c/li\u003e\n\u003cli\u003e\u003ccode\u003eflyto-core\u003c/code\u003e performs an SSRF check, which validates that the attacker's public URL is not a private IP, allowing the request to proceed.\u003c/li\u003e\n\u003cli\u003eThe library retrieves the operator's secret key from environment variables (e.g., \u003ccode\u003eOPENAI_API_KEY\u003c/code\u003e).\u003c/li\u003e\n\u003cli\u003eThe library transmits a POST request to the attacker's server, attaching the secret key in the \u003ccode\u003eAuthorization: Bearer\u003c/code\u003e header.\u003c/li\u003e\n\u003cli\u003eAttacker logs the incoming request, extracts the Bearer token, and uses it to perform unauthorized API calls on behalf of the victim.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation results in the exfiltration of high-privilege cloud LLM and vector database credentials. Attackers can leverage these keys to incur fraudulent billing costs, exfiltrate sensitive data accessible to the LLM or vector store, or manipulate internal AI workflows. The ease of triggering this via the library's exposed API surfaces makes this a critical risk for any organization utilizing vulnerable versions of \u003ccode\u003eflyto-core\u003c/code\u003e.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eUpgrade \u003ccode\u003eflyto-core\u003c/code\u003e to version 2.26.7 or higher immediately to apply the vendor-supplied patches (CVE-2026-67425).\u003c/li\u003e\n\u003cli\u003eAudit application code to identify all calls to \u003ccode\u003ellm.chat\u003c/code\u003e, \u003ccode\u003eai.model\u003c/code\u003e, \u003ccode\u003ellm.agent\u003c/code\u003e, and \u003ccode\u003evector.connector\u003c/code\u003e where user-controlled input influences the \u003ccode\u003ebase_url\u003c/code\u003e parameter.\u003c/li\u003e\n\u003cli\u003eImplement strict allowlisting for allowed API endpoints rather than relying on SSRF guards for credential-handling components.\u003c/li\u003e\n\u003cli\u003eRotate any API keys that were potentially exposed in environment variables if the application was reachable by untrusted actors.\u003c/li\u003e\n\u003c/ol\u003e\n","date_modified":"2026-07-30T15:29:38Z","date_published":"2026-07-30T15:29:30Z","id":"https://feed.craftedsignal.io/briefs/2026-07-flyto-core-leak/","summary":"Flyto-core versions prior to 2.26.7 allow unauthenticated callers to exfiltrate API provider keys by supplying a malicious 'base_url' parameter, which forces the library to append operator-configured secrets to requests sent to attacker-controlled infrastructure.","title":"Credential Exfiltration via Unrestricted Base URL in Flyto-core","url":"https://feed.craftedsignal.io/briefs/2026-07-flyto-core-leak/"},{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"cvss":9.3,"id":"CVE-2026-67426"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Flyto Core"],"_cs_severities":["critical"],"_cs_tags":["ssrf","credential-theft","vulnerability","cve-2026-67426","path-traversal","arbitrary-file-write","rce","framework"],"_cs_type":"threat","_cs_vendors":["Flyto"],"content_html":"\u003cp\u003eFlyto Core versions 2.26.6 and earlier are vulnerable to a critical SSRF and credential exfiltration flaw in the \u003ccode\u003eflyto-verification\u003c/code\u003e service. The \u003ccode\u003e/run\u003c/code\u003e endpoint, which is exposed by default on all interfaces (0.0.0.0) via the standard Docker configuration, lacks authentication. When a request is submitted to this endpoint, the \u003ccode\u003ecallback_url\u003c/code\u003e parameter is processed without validation against an allowlist or SSRF protection guards.\u003c/p\u003e\n\u003cp\u003eCrucially, the service automatically appends the internal \u003ccode\u003eFLYTO_RUNNER_SECRET\u003c/code\u003e as an \u003ccode\u003eX-Internal-Key\u003c/code\u003e header to any outgoing request initiated by the \u003ccode\u003ecallback_url\u003c/code\u003e. An attacker can specify an arbitrary URL, forcing the service to send the secret to an attacker-controlled listener. This exfiltration allows for the impersonation of the service when communicating with the primary engine. Furthermore, the vulnerability enables SSRF attacks against internal network resources or cloud metadata services (e.g., 169.254.169.254) using arbitrary JSON payloads.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker identifies a reachable Flyto Core verification service listening on port 8344 on a target network.\u003c/li\u003e\n\u003cli\u003eAttacker crafts an unauthenticated \u003ccode\u003ePOST\u003c/code\u003e request to the \u003ccode\u003e/run\u003c/code\u003e endpoint.\u003c/li\u003e\n\u003cli\u003eAttacker sets the \u003ccode\u003ecallback_url\u003c/code\u003e parameter to a malicious URI (e.g., \u003ccode\u003ehttp://attacker-controlled-host.tld/\u003c/code\u003e).\u003c/li\u003e\n\u003cli\u003eThe service receives the request and fails to validate the \u003ccode\u003ecallback_url\u003c/code\u003e against the expected \u003ccode\u003etarget_allowed\u003c/code\u003e allowlist.\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003epost_callback\u003c/code\u003e function prepares an outbound request, fetching the \u003ccode\u003eFLYTO_RUNNER_SECRET\u003c/code\u003e from the process environment.\u003c/li\u003e\n\u003cli\u003eThe service sends the request to the attacker's URI, including the \u003ccode\u003eX-Internal-Key\u003c/code\u003e header containing the secret.\u003c/li\u003e\n\u003cli\u003eAttacker captures the \u003ccode\u003eFLYTO_RUNNER_SECRET\u003c/code\u003e from the incoming request logs.\u003c/li\u003e\n\u003cli\u003eAttacker uses the stolen secret to authenticate and forge legitimate callbacks to the primary Flyto engine.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation leads to a total loss of confidentiality regarding the internal runner secret and potential full compromise of the Flyto workflow engine. By bypassing authentication, attackers can interact with internal cloud metadata services, exfiltrate sensitive environment configuration, and gain the ability to submit unauthorized workflows or callbacks, effectively masquerading as a legitimate runner.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eImmediately restrict access to the \u003ccode\u003e/run\u003c/code\u003e endpoint using network-level controls (e.g., firewall rules or security groups) so it is only accessible from trusted internal IP ranges.\u003c/li\u003e\n\u003cli\u003eBind the \u003ccode\u003eflyto-verification\u003c/code\u003e service to \u003ccode\u003e127.0.0.1\u003c/code\u003e instead of \u003ccode\u003e0.0.0.0\u003c/code\u003e in the \u003ccode\u003eDockerfile\u003c/code\u003e and service configuration to prevent exposure to external network segments.\u003c/li\u003e\n\u003cli\u003ePatch to a version where \u003ccode\u003ecallback_url\u003c/code\u003e is validated against a strict allowlist and protected by SSRF guards.\u003c/li\u003e\n\u003cli\u003eRotate the \u003ccode\u003eFLYTO_RUNNER_SECRET\u003c/code\u003e immediately, as any instance running 2.26.6 or earlier must be assumed to have had this secret compromised.\u003c/li\u003e\n\u003cli\u003eImplement authentication (e.g., via OAuth or API keys) for all endpoints in the \u003ccode\u003eflyto-verification\u003c/code\u003e service to ensure that only authorized users can trigger the execution workflow.\u003c/li\u003e\n\u003c/ol\u003e\n","date_modified":"2026-07-30T15:29:13Z","date_published":"2026-07-30T15:29:02Z","id":"https://feed.craftedsignal.io/briefs/2026-07-flyto-ssrf-exfiltration/","summary":"An unauthenticated SSRF vulnerability in the Flyto Core /run endpoint allows attackers to exfiltrate the internal FLYTO_RUNNER_SECRET and perform unauthorized requests against internal infrastructure.","title":"Unauthenticated SSRF and Secret Exfiltration in Flyto Core","url":"https://feed.craftedsignal.io/briefs/2026-07-flyto-ssrf-exfiltration/"}],"language":"en","title":"CraftedSignal Threat Feed - Flyto","version":"https://jsonfeed.org/version/1.1"}