CVE-2026-67428

Name of the Vulnerable Software and Affected Versions Flyto2 Core versions prior to 2.26.7

Description HTTP-emitting modules fetch caller-controlled URLs without using the validate url with env config function, which allows Server-Side Request Forgery (SSRF) to internal or metadata endpoints. SSRF is a flaw that allows an attacker to induce the server-side application to make requests to an unintended location. The affected components include src/core/modules/third party/developer/http/requests.py, core.api.http get, core.api.http post, graphql.query, graphql.mutation, monitor.http check, communication.slack send, notification.discord.send message, notification.slack.send message, notification.teams.send message, ai.vision analyze, verify.visual diff, browser.proxy rotate, and the agent and llm inline base url branch.

Recommendations Update to version 2.26.7.