CVE-2026-67426

Name of the Vulnerable Software and Affected Versions Flyto2 Core versions prior to 2.26.7

Description The standalone flyto-verification service in src/core/verification service.py exposes an unauthenticated POST '/run' endpoint on 0.0.0.0:8344. The service uses a client-supplied callback url for an outbound POST request that includes the X-Internal-Key header containing the $FLYTO RUNNER SECRET value. This process bypasses the target allowed check, enabling unauthenticated Server-Side Request Forgery (SSRF)—a technique where an attacker forces a server to make requests to an unintended location—and the exfiltration of the runner secret.

Recommendations Update to version 2.26.7. Restrict access to the '/run' endpoint in the flyto-verification service to minimize the risk of exploitation.