Flyto2 Core: Multiple HTTP-family modules fetch client-controlled URLs without the SSRF guard their siblings apply (SSRF to internal/metadata)

🗓️ 30 Jul 2026 14:48:05Reported by GitHub Advisory DatabaseType

Multiple HTTP modules call client-controlled URLs without the SSRF guard, exposing internal and metadata endpoints.

Reporter	Title	Published	Views	Family All 10
ATTACKERKB	CVE-2026-67428	29 Jul 202618:48	–	attackerkb
Circl	CVE-2026-67428	29 Jul 202620:00	–	circl
CVE	CVE-2026-67428	29 Jul 202618:48	–	cve
Cvelist	CVE-2026-67428 Flyto2 Core: Multiple HTTP-family modules fetch client-controlled URLs without the SSRF guard their siblings apply (SSRF to internal/metadata)	29 Jul 202618:48	–	cvelist
EUVD	EUVD-2026-50472	30 Jul 202614:48	–	euvd
NVD	CVE-2026-67428	29 Jul 202619:16	–	nvd
OSV	CVE-2026-67428 Flyto2 Core: Multiple HTTP-family modules fetch client-controlled URLs without the SSRF guard their siblings apply (SSRF to internal/metadata)	29 Jul 202618:48	–	osv
OSV	GHSA-PGWH-4JJ4-QM8V Flyto2 Core: Multiple HTTP-family modules fetch client-controlled URLs without the SSRF guard their siblings apply (SSRF to internal/metadata)	30 Jul 202614:48	–	osv
Positive Technologies	PT-2026-65895	29 Jul 202600:00	–	ptsecurity
Vulnrichment	CVE-2026-67428 Flyto2 Core: Multiple HTTP-family modules fetch client-controlled URLs without the SSRF guard their siblings apply (SSRF to internal/metadata)	29 Jul 202618:48	–	vulnrichment

Vulners

Node

flyto-coreRange≤2.26.6pip

Source	Link
github	www.github.com/flytohub/flyto-core/security/advisories/GHSA-pgwh-4jj4-qm8v
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-67428
github	www.github.com/flytohub/flyto-core/commit/0a0a528520ec18f5a21f1ddf858a71cc1edfb6e9
github	www.github.com/flytohub/flyto-core/releases/tag/v2.26.7
github	www.github.com/advisories/GHSA-pgwh-4jj4-qm8v

30 Jul 2026 14:48Current

6Medium risk

Vulners AI Score6

CVSS 3.18.5

SSVC