PyPI/flyto-core CVE-2026-67424: high 8.5

Flyto2 Core: Guarded HTTP modules follow redirects into internal space without per-hop SSRF revalidation

Action: Upgrade flyto-core to 2.26.7 or later.

pip install flyto-core==2.26.7

Affected

Fixed versions

Sources

• osv: PYSEC-2026-3569
• https://github.com/flytohub/flyto-core/security/advisories/GHSA-c9hr-64h3-gxpc
• https://nvd.nist.gov/vuln/detail/CVE-2026-67424
• https://github.com/flytohub/flyto-core/commit/0a0a528520ec18f5a21f1ddf858a71cc1edfb6e9
• https://github.com/flytohub/flyto-core
• https://github.com/flytohub/flyto-core/releases/tag/v2.26.7
• https://pypi.org/project/flyto-core
• https://github.com/advisories/GHSA-c9hr-64h3-gxpc

CVE-2026-67424 · published 2026-08-04T11:34:45.694Z · modified 2026-08-04T14:30:27.320502247Z · JSON