CVE-2026-67424

Name of the Vulnerable Software and Affected Versions Flyto2 Core versions prior to 2.26.7

Description The HTTP modules http.get, http.request, and http.batch validate only the initial URL. When allow redirects is set to True, the system follows redirects without per-hop Location revalidation. This allows a public URL to redirect into internal address space, enabling the retrieval of internal response bodies.

Recommendations Update to version 2.26.7.