{"uuid": "71ac4475-4c44-4db7-873a-b485a02a5d2a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-hr7p-wg7r-hg9m", "type": "seen", "source": "https://gist.github.com/alon710/937397e52a8e0970b2abb603a8f2aff3", "content": "# CVE-2026-67427: CVE-2026-67427: Host Environment Variable Access Policy Bypass via Template Interpolation in Flyto2 Core\n\n> **CVSS Score:** 8.6\n> **Published:** 2026-07-30\n> **Full Report:** https://cvereports.com/reports/CVE-2026-67427\n\n## Summary\nCVE-2026-67427 is a capability bypass vulnerability in the Flyto2 Core workflow execution kernel. Due to a logical inconsistency in how dynamic parameters are resolved, the system evaluates environment variables via template interpolation prior to executing capability filter validation. This permits unprivileged workflow definitions to completely bypass denylist restrictions on the `env.get` module, exfiltrating critical host configurations, API tokens, and credentials via allowed communication channels.\n\n## TL;DR\nA logical separation-of-duty flaw in Flyto2 Core's parser allows workflows to bypass security policies. By embedding '${env.VARIABLE}' template strings inside allowed modules, attackers can extract system-level credentials without trigger-blocking module denylists.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-693 (Protection Mechanism Failure)\n- **Attack Vector**: Network\n- **CVSS v3.1 Score**: 8.6 (High)\n- **EPSS Score**: 0.00339 (Percentile: 26.51%)\n- **Impact**: Information Disclosure (Host Secret Extraction)\n- **Exploit Status**: Proof-of-Concept / Technical Analysis\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- Flyto2 Core\n- **flyto-core**: < 2.26.6 (Fixed in: `2.26.6`)\n\n## Mitigation\n\n- Upgrade flyto-core to version 2.26.6 or higher.\n- Define explicit environment variable boundaries using the newly introduced FLYTO_ENV_VAR_ALLOWLIST variable.\n- Isolate automation container runtimes and limit the configuration variables exposed to host processes.\n\n**Remediation Steps:**\n1. Identify all production and test environments running flytohub/flyto-core versions below 2.26.6.\n2. Update project configuration files and build specifications to require version 2.26.6.\n3. Apply the FLYTO_ENV_VAR_ALLOWLIST environment variable in service deployment manifests to restrict dynamic template resolution.\n4. Review historical workflow execution records and audit logs for patterns resembling dynamic variable interpolation calls.\n\n## References\n\n- [GitHub Security Advisory GHSA-hr7p-wg7r-hg9m](https://github.com/flytohub/flyto-core/security/advisories/GHSA-hr7p-wg7r-hg9m)\n- [Fix Commit d5f89d7](https://github.com/flytohub/flyto-core/commit/d5f89d71303e3c1e6418d347c5c55fcd173cc8cc)\n- [Flyto Core v2.26.6 Release Notes](https://github.com/flytohub/flyto-core/releases/tag/v2.26.6)\n- [Official CVE Record](https://www.cve.org/CVERecord?id=CVE-2026-67427)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-67427) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-07-30T23:32:08.924237Z"}