{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","feed_url":"https://feed.craftedsignal.io/vendors/flyto2/feed.json","home_page_url":"https://feed.craftedsignal.io/","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"cvss":8.5,"id":"CVE-2026-67424"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Flyto2 Core (2.26.6)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["Flyto2"],"content_html":"\u003cp\u003eFlyto2 Core versions 2.26.6 and earlier contain a critical Server-Side Request Forgery (SSRF) vulnerability due to improper handling of HTTP redirects. The application's HTTP modules, including \u003ccode\u003ehttp.get\u003c/code\u003e, \u003ccode\u003ehttp.request\u003c/code\u003e, and \u003ccode\u003ehttp.batch\u003c/code\u003e, perform initial URL validation against an allowlist before execution. However, these modules rely on the default behavior of the aiohttp library, which automatically follows HTTP redirects without performing per-hop revalidation.\u003c/p\u003e\n\u003cp\u003eAn attacker can bypass security controls by providing a malicious public-facing URL that returns a 302 redirect to an internal IP address or sensitive cloud metadata endpoint (e.g., \u003ccode\u003e169.254.169.254\u003c/code\u003e). Because the application does not inspect the \u003ccode\u003eLocation\u003c/code\u003e header or re-verify the redirect target against the internal allowlist, the aiohttp client transparently follows the request to the restricted resource. This results in the potential exfiltration of sensitive internal configuration, metadata, or other network-accessible data. This vulnerability affects all deployments using standard module configurations where redirects are permitted by the underlying client.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker identifies a target application utilizing Flyto2 Core for external HTTP requests.\u003c/li\u003e\n\u003cli\u003eAttacker hosts a public, innocuous-looking URL (e.g., \u003ccode\u003ehttp://attacker.tld/r\u003c/code\u003e) configured to return an HTTP 302 redirect.\u003c/li\u003e\n\u003cli\u003eAttacker triggers a request to the target application, passing the public URL to a vulnerable function like \u003ccode\u003ehttp.get\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eThe target application's \u003ccode\u003evalidate_url_with_env_config\u003c/code\u003e function evaluates the initial URL (\u003ccode\u003eattacker.tld\u003c/code\u003e), which is deemed safe, and passes validation.\u003c/li\u003e\n\u003cli\u003eThe application invokes \u003ccode\u003esession.get(url)\u003c/code\u003e via aiohttp, which by default is set to \u003ccode\u003eallow_redirects=True\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eThe aiohttp client receives the 302 redirect and automatically initiates a new request to the internal destination (e.g., \u003ccode\u003ehttp://169.254.169.254/...\u003c/code\u003e).\u003c/li\u003e\n\u003cli\u003eNo per-hop validation occurs, allowing the request to succeed against the internal host.\u003c/li\u003e\n\u003cli\u003eThe sensitive data returned from the internal host is relayed back to the attacker as the final response body.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows for unauthorized access to internal services and cloud metadata endpoints that are otherwise unreachable from the public internet. This can lead to the exposure of credentials, environment variables, or other sensitive infrastructure details. The vulnerability affects all users of Flyto2 Core versions 2.26.6 and earlier.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eUpgrade Flyto2 Core to the latest patched version once available to address CVE-2026-67424.\u003c/li\u003e\n\u003cli\u003eIf an immediate upgrade is not feasible, implement manual revalidation of the \u003ccode\u003eLocation\u003c/code\u003e header in the HTTP module codebase by disabling \u003ccode\u003eallow_redirects\u003c/code\u003e and explicitly checking redirect targets against the allowlist.\u003c/li\u003e\n\u003cli\u003eDeploy egress filtering on servers running Flyto2 Core to restrict access to internal IP ranges (e.g., 169.254.0.0/16, 127.0.0.0/8) from the application process.\u003c/li\u003e\n\u003c/ol\u003e\n","date_modified":"2026-07-30T15:29:20Z","date_published":"2026-07-30T15:29:20Z","id":"https://feed.craftedsignal.io/briefs/2026-07-flyto2-core-ssrf/","summary":"Flyto2 Core HTTP modules perform insufficient SSRF revalidation on HTTP redirects, allowing attackers to reach internal resources and cloud metadata services.","title":"Flyto2 Core SSRF via Insecure Redirect Handling","url":"https://feed.craftedsignal.io/briefs/2026-07-flyto2-core-ssrf/"}],"language":"en","title":"CraftedSignal Threat Feed - Flyto2","version":"https://jsonfeed.org/version/1.1"}