CVE-2026-67428

creationtimestamp| type| source ---|---|--- 2026-07-29 20:00:43+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mrspokmwlf2g 2026-07-30 16:30:59+00:00| seen| https://gist.github.com/alon710/abbfb678b2ea15b959183e89124a0f42 2026-07-30 16:35:05+00:00| published-proof-of-concep...

CVE-2026-67428 Flyto2 Core: Multiple HTTP-family modules fetch client-controlled URLs without the SSRF guard their siblings apply (SSRF to internal/metadata)

Flyto2 Core is an execution kernel for automation and AI-agent workflows. Prior to 2.26.7, HTTP-emitting modules including src/core/modules/thirdparty/developer/http/requests.py, core.api.httpget, core.api.httppost, graphql.query, graphql.mutation, monitor.httpcheck, communication.slacksend,...