Attack Chain

1. Attacker identifies an exposed application interface that interacts with flyto-core and allows user-supplied parameters.
2. Attacker crafts a payload specifically targeting the base_url parameter within the library's llm.chat or ai.model functions.
3. Attacker points base_url to a custom-controlled public web server capable of capturing inbound HTTP headers.
4. The victim application receives the malicious request and passes the base_url parameter to the vulnerable library functions.
5. flyto-core performs an SSRF check, which validates that the attacker's public URL is not a private IP, allowing the request to proceed.
6. The library retrieves the operator's secret key from environment variables (e.g., OPENAI_API_KEY).
7. The library transmits a POST request to the attacker's server, attaching the secret key in the Authorization: Bearer header.
8. Attacker logs the incoming request, extracts the Bearer token, and uses it to perform unauthorized API calls on behalf of the victim.

Impact

Successful exploitation results in the exfiltration of high-privilege cloud LLM and vector database credentials. Attackers can leverage these keys to incur fraudulent billing costs, exfiltrate sensitive data accessible to the LLM or vector store, or manipulate internal AI workflows. The ease of triggering this via the library's exposed API surfaces makes this a critical risk for any organization utilizing vulnerable versions of flyto-core.

Recommendation

1. Upgrade flyto-core to version 2.26.7 or higher immediately to apply the vendor-supplied patches (CVE-2026-67425).
2. Audit application code to identify all calls to llm.chat, ai.model, llm.agent, and vector.connector where user-controlled input influences the base_url parameter.
3. Implement strict allowlisting for allowed API endpoints rather than relying on SSRF guards for credential-handling components.
4. Rotate any API keys that were potentially exposed in environment variables if the application was reachable by untrusted actors.

Crucially, the service automatically appends the internal FLYTO_RUNNER_SECRET as an X-Internal-Key header to any outgoing request initiated by the callback_url. An attacker can specify an arbitrary URL, forcing the service to send the secret to an attacker-controlled listener. This exfiltration allows for the impersonation of the service when communicating with the primary engine. Furthermore, the vulnerability enables SSRF attacks against internal network resources or cloud metadata services (e.g., 169.254.169.254) using arbitrary JSON payloads.

Attack Chain

1. Attacker identifies a reachable Flyto Core verification service listening on port 8344 on a target network.
2. Attacker crafts an unauthenticated POST request to the /run endpoint.
3. Attacker sets the callback_url parameter to a malicious URI (e.g., http://attacker-controlled-host.tld/).
4. The service receives the request and fails to validate the callback_url against the expected target_allowed allowlist.
5. The post_callback function prepares an outbound request, fetching the FLYTO_RUNNER_SECRET from the process environment.
6. The service sends the request to the attacker's URI, including the X-Internal-Key header containing the secret.
7. Attacker captures the FLYTO_RUNNER_SECRET from the incoming request logs.
8. Attacker uses the stolen secret to authenticate and forge legitimate callbacks to the primary Flyto engine.

Impact

Successful exploitation leads to a total loss of confidentiality regarding the internal runner secret and potential full compromise of the Flyto workflow engine. By bypassing authentication, attackers can interact with internal cloud metadata services, exfiltrate sensitive environment configuration, and gain the ability to submit unauthorized workflows or callbacks, effectively masquerading as a legitimate runner.

Recommendation

1. Immediately restrict access to the /run endpoint using network-level controls (e.g., firewall rules or security groups) so it is only accessible from trusted internal IP ranges.
2. Bind the flyto-verification service to 127.0.0.1 instead of 0.0.0.0 in the Dockerfile and service configuration to prevent exposure to external network segments.
3. Patch to a version where callback_url is validated against a strict allowlist and protected by SSRF guards.
4. Rotate the FLYTO_RUNNER_SECRET immediately, as any instance running 2.26.6 or earlier must be assumed to have had this secret compromised.
5. Implement authentication (e.g., via OAuth or API keys) for all endpoints in the flyto-verification service to ensure that only authorized users can trigger the execution workflow.