Loading story…
Flytohub disclosed and fixed three vulnerabilities in Flyto Core, the execution kernel for automation and AI-agent workflows, affecting versions earlier than 2.26.6. The most severe issue, CVE-2026-67429, allowed unauthenticated attackers to write attacker-controlled response data to arbitrary filesystem paths because file-writing modules such as image.download trusted a caller-supplied output_dir instead of enforcing confinement to FLYTO_SANDBOX_DIR. Two additional high-severity flaws, CVE-2026-67427 and CVE-2026-67425, allowed workflows to read arbitrary host environment variables through ${env.VAR} interpolation and leak environment-derived LLM or API keys such as OPENAI_API_KEY and ANTHROPIC_API_KEY to attacker-controlled base_url endpoints.
Flyto Core 2.26.6 was released as a security update with a central path guard for file writes, deny-by-default handling for ${env.*} with optional allowlisting via FLYTO_ENV_VAR_ALLOWLIST, and trusted-host restrictions for forwarding environment-derived credentials through FLYTO_TRUSTED_LLM_HOSTS. GitHub and CVE records indicate proof-of-concept exploitation and automatable attack paths, and one report noted the credential-forwarding flaw could expose high-privilege API keys through outbound Authorization: Bearer headers even when SSRF protections blocked only private or metadata targets. Users were advised to upgrade from 2.26.5 or earlier immediately.
Track how attackers are adapting to this technology.
5 events from the most recent confirmed update back to the earliest known activity.
The CVE-2026-67429 record was modified on July 29, 2026 to add references and SSVC metadata. The added metadata indicated proof-of-concept exploitation, automatable exploitation, and total technical impact.
The CVE-2026-67425 record was updated on July 29, 2026 to add references to the GitHub advisory, fix commit, and release tag. The update also added SSVC metadata indicating proof-of-concept exploitation, automatable attack potential, and partial technical impact.
Flytohub released Flyto Core version 2.26.6 as a security update addressing the three disclosed vulnerabilities. Users were advised to upgrade from 2.26.5 to 2.26.6.
A security fix commit added path confinement for file-writing modules, deny-by-default handling for ${env.*} interpolation, and trusted-host restrictions for environment-derived credentials. The commit also states the fixes were verified against the reporter’s proof of concept.
Flytohub disclosed that three vulnerabilities were reported through GitHub private vulnerability reporting on 2026-07-07. The issues covered arbitrary file write, environment variable access control bypass, and leakage of environment-derived LLM or API keys.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Follow how adversaries are adapting to this technology, and where it touches your stack today.
6 references tracked. Mallory keeps watching after this page renders.
cvereports.com
Open sourcecvefeed.io
Open sourcecvefeed.io
Open sourcecvefeed.io
Open sourcegithub.com
Open sourcegithub.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Flytohub patched **Flyto2 Core** in version `2.26.7` to fix several high-severity server-side request forgery flaws that could let remote attackers reach internal services and cloud metadata endpoints. One issue, tracked as `CVE-2026-67428`, affected multiple HTTP-capable modules and inline `base_url` handling that accepted caller-controlled URLs without applying the platform’s `validate_url_with_env_config` safeguard. Another, `CVE-2026-67424`, allowed modules including `http.get`, `http.request`, and `http.batch` to validate only the initial URL and then follow redirects into internal address space without rechecking each hop, potentially exposing internal response data. A separate flaw, `CVE-2026-67426`, exposed the standalone `flyto-verification` service through an unauthenticated `POST /run` endpoint on `0.0.0.0:8344` that trusted a user-supplied `callback_url` and sent an outbound request containing the `X-Internal-Key` header populated from `$FLYTO_RUNNER_SECRET`, enabling SSRF and secret exfiltration. Flytohub’s remediation adds per-request and per-redirect URL validation, blocks access to internal and metadata targets across HTTP, GraphQL, webhook, browser, vision, and monitoring modules, and now requires an `X-Internal-Key` shared secret for `/run`, with the service failing closed if no secret is configured.
Jul 31, 2026
Two high-severity vulnerabilities were disclosed affecting exposed application and device management surfaces, including a flaw that can give attackers **root access** and another that enables **arbitrary file write** through path traversal. **CVE-2026-3587** describes an unauthenticated remote attack path in a hidden CLI function that lets an attacker escape a restricted prompt and gain root access to the underlying Linux operating system, potentially leading to full device compromise. The issue was mapped to `CWE-912` and assigned a `CVSS v3.1` score vector of `AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H`, with CERT VDE publishing advisory `VDE-2026-020`. A separate vulnerability, **CVE-2026-5027**, affects Langflow's `POST /api/v2/files` endpoint, where improper sanitization of the multipart `filename` parameter allows path traversal using `../` sequences. An authenticated attacker can exploit the bug to write files to arbitrary filesystem locations, creating a route to compromise confidentiality, integrity, and availability. The flaw was classified as `CWE-22`, carries the `CVSS v3.1` vector `AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H`, and is referenced in Tenable advisory `TRA-2026-26`.
Jun 29, 2026
Five critical vulnerabilities were discovered in Fluent Bit, a widely used open-source telemetry and log collection agent deployed across major cloud providers and AI labs. These flaws, some of which have existed for years, allow attackers to bypass authentication, perform path traversal, achieve remote code execution, cause denial-of-service, and manipulate log tags. The vulnerabilities, identified by Oligo Security, affect all major cloud platforms and have the potential to disrupt cloud services, alter or tamper with data, and enable deeper intrusions into cloud and Kubernetes infrastructure. Fluent Bit is used by tech giants such as Google, Amazon, Oracle, IBM, Microsoft, and OpenAI, with over 15 billion deployments worldwide. The vulnerabilities include CVE-2025-12972 (path traversal via unsanitized tag values), CVE-2025-12970 (stack buffer overflow in the Docker Metrics input plugin), CVE-2025-12978 (tag-matching logic spoofing), CVE-2025-12977 (improper input validation of tags), and CVE-2025-12969 (missing authentication in the in_forward plugin). Exploiting these flaws could allow attackers to write or overwrite arbitrary files, inject malicious records, reroute logs, and flood security products with false events. The issues have been addressed in Fluent Bit versions v4.1.1 and 4.0.12, and users are urged to update immediately to mitigate risk.
Jun 29, 2026