CVE-2026-67426

Flyto2 Core contains an unauthenticated SSRF risk in the standalone flyto-verification service (src/core/verification_service.py) prior to version 2.26.7. The service exposed POST /run on 0.0.0.0:8344 and used a client-supplied callback_url for outbound POSTs with X-Internal-Key: $FLYTO_RUNNER_SE...

PT-2026-65893

Flyto2 Core is an execution kernel for automation and AI-agent workflows. Prior to 2.26.7, the standalone flyto-verification service in src/core/verification service.py exposes unauthenticated POST /run on 0.0.0.0:8344 and uses client-supplied callback url for an outbound POST with X-Internal-Key...