---
cve: "CVE-2026-67426"
severity: "CRITICAL"
cvss: 9.3
epss: "0.4%"
vendor: "flytohub"
kev: false
exploited: false
published: "2026-07-29 18:43:26"
tags: [cve, security, critical]
source: tsecurity.de CVE-Dossier
exported: "2026-10-28T19:32:45+01:00"
---

# CVE-2026-67426

> 9.3 CRITICAL · 🧪 PoC

## Beschreibung

Flyto2 Core is an execution kernel for automation and AI-agent workflows. Prior to 2.26.7, the standalone flyto-verification service in src/core/verification_service.py exposes unauthenticated POST /run on 0.0.0.0:8344 and uses client-supplied callback_url for an outbound POST with X-Internal-Key: $FLYTO_RUNNER_SECRET while bypassing target_allowed, allowing unauthenticated SSRF and runner secret exfiltration. This issue is fixed in version 2.26.7.

## CNA-Record (Kanon, cvelistV5)

- CNA: **GitHub_M**
- State: PUBLISHED
- Stand: 2026-07-29 19:05:05
- CNA-CVSS: **9.3** (`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N`)

## CISA-Anreicherung (vulnrichment/ADP)

- CISA-SSVC (Coordinator, v2.0.3):
  - Exploitation: **poc**
  - Automatable: **yes**
  - Technical Impact: **partial**

## CVSS-Vektor

```
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N
```

| Metrik | Wert | Bewertung |
|---|---|---|
| AV Angriffsvektor | Netzwerk | bad |
| AC Komplexität | Gering | bad |
| PR Privilegien | Keine | bad |
| UI Interaktion | Keine | bad |
| S Scope | Verändert | bad |
| C Vertraulichkeit | Hoch | bad |
| I Integrität | Gering | warn |
| A Verfügbarkeit | Keine | good |

## Schwachstellen-Klasse

- **CWE-306** — Missing Authentication for Critical Function
  The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.
- **CWE-522** — Insufficiently Protected Credentials
  The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.
- **CWE-918** — Server-Side Request Forgery (SSRF)
  The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

## Angriffsmuster (CAPEC)

- [CAPEC-12 — Choosing Message Identifier](https://capec.mitre.org/data/definitions/12.html) _(Severity: High)_
- [CAPEC-36 — Using Unpublished Interfaces or Functionality](https://capec.mitre.org/data/definitions/36.html) _(Severity: High)_
- [CAPEC-62 — Cross Site Request Forgery](https://capec.mitre.org/data/definitions/62.html) _(Severity: Very High)_
- [CAPEC-166 — Force the System to Reset Values](https://capec.mitre.org/data/definitions/166.html) _(Severity: Medium)_
- [CAPEC-216 — Communication Channel Manipulation](https://capec.mitre.org/data/definitions/216.html)

## Patch verfügbar (OSV)

- 9449def37907190798b5d677b716526b09ae7302 (Commit)
- 0a0a528520ec18f5a21f1ddf858a71cc1edfb6e9 (Commit)

## Referenzen

- <https://github.com/flytohub/flyto-core/security/advisories/GHSA-jx74-cqjv-2c67>
- <https://github.com/flytohub/flyto-core/commit/0a0a528520ec18f5a21f1ddf858a71cc1edfb6e9>
- <https://github.com/flytohub/flyto-core/releases/tag/v2.26.7>

---
_Exportiert aus dem [tsecurity.de CVE-Dossier](https://tsecurity.de/sicherheitsluecken/cve-2026-67426/) · Datenquellen: EUVD (ENISA), NVD, OSV, CISA KEV, FIRST EPSS, Exploit-DB, BSI WID (CSAF)_