Flyto2 Core: Multiple HTTP-family modules fetch client-controlled URLs without the SSRF guard their siblings apply (SSRF to internal/metadata)

🗓️ 04 Aug 2026 11:34:45Reported by Python Packaging AdvisoryType

pypa🔗 github.com👁 4 Views

Multiple HTTP modules fetch client-controlled URLs without SSRF guard, risking access to internal and metadata endpoints.

Reporter	Title	Published	Views	Family All 12
ATTACKERKB	CVE-2026-67428	29 Jul 202618:48	–	attackerkb
Circl	CVE-2026-67428	29 Jul 202620:00	–	circl
CVE	CVE-2026-67428	29 Jul 202618:48	–	cve
Cvelist	CVE-2026-67428 Flyto2 Core: Multiple HTTP-family modules fetch client-controlled URLs without the SSRF guard their siblings apply (SSRF to internal/metadata)	29 Jul 202618:48	–	cvelist
EUVD	EUVD-2026-50472	30 Jul 202614:48	–	euvd
Github Security Blog	Flyto2 Core: Multiple HTTP-family modules fetch client-controlled URLs without the SSRF guard their siblings apply (SSRF to internal/metadata)	30 Jul 202614:48	–	github
NVD	CVE-2026-67428	29 Jul 202619:16	–	nvd
OSV	GHSA-PGWH-4JJ4-QM8V Flyto2 Core: Multiple HTTP-family modules fetch client-controlled URLs without the SSRF guard their siblings apply (SSRF to internal/metadata)	30 Jul 202614:48	–	osv
OSV	PYSEC-2026-3572 Flyto2 Core: Multiple HTTP-family modules fetch client-controlled URLs without the SSRF guard their siblings apply (SSRF to internal/metadata)	4 Aug 202611:34	–	osv
Positive Technologies	PT-2026-65895	29 Jul 202600:00	–	ptsecurity

Vulners

Node

pypi flyto-coreRange0–2.26.7

Source	Link
github	www.github.com/flytohub/flyto-core/security/advisories/GHSA-pgwh-4jj4-qm8v
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-67428
github	www.github.com/flytohub/flyto-core/commit/0a0a528520ec18f5a21f1ddf858a71cc1edfb6e9
github	www.github.com/flytohub/flyto-core
github	www.github.com/flytohub/flyto-core/releases/tag/v2.26.7
pypi	www.pypi.org/project/flyto-core
github	www.github.com/advisories/GHSA-pgwh-4jj4-qm8v

04 Aug 2026 13:36Current

5.7Medium risk

Vulners AI Score5.7

CVSS 3.18.5

EPSS0.00337

SSVC