CVE-2026-67426
2 advisories.
PyPI/flyto-core CVE-2026-67426: critical 9.3, EPSS 0.51%
Flyto2 Core: Unauthenticated flyto-verification /run: callback_url SSRF and internal runner-secret exfiltration
Action: Upgrade flyto-core to 2.26.7 or later.
pip install flyto-core==2.26.7Affected
| introduced | fixed | last affected |
|---|---|---|
| 2.26.6 | 2.26.7 | - |
Fixed versions
| 2.26.7 |
Sources
- osv: GHSA-jx74-cqjv-2c67
- https://github.com/flytohub/flyto-core/security/advisories/GHSA-jx74-cqjv-2c67
- https://nvd.nist.gov/vuln/detail/CVE-2026-67426
- https://github.com/flytohub/flyto-core/commit/0a0a528520ec18f5a21f1ddf858a71cc1edfb6e9
- https://github.com/flytohub/flyto-core
- https://github.com/flytohub/flyto-core/releases/tag/v2.26.7
- https://github.com/pypa/advisory-database/tree/main/vulns/flyto-core/PYSEC-2026-3571.yaml
CVE-2026-67426 · published · modified · JSON
PyPI/flyto-core CVE-2026-67426: critical 9.3, EPSS 0.51%
Flyto2 Core: Unauthenticated flyto-verification /run: callback_url SSRF and internal runner-secret exfiltration
Action: Upgrade flyto-core to 2.26.7 or later.
pip install flyto-core==2.26.7Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 2.26.7 | - |
Fixed versions
| 2.26.7 |
Sources
- osv: PYSEC-2026-3571
- https://github.com/flytohub/flyto-core/security/advisories/GHSA-jx74-cqjv-2c67
- https://nvd.nist.gov/vuln/detail/CVE-2026-67426
- https://github.com/flytohub/flyto-core/commit/0a0a528520ec18f5a21f1ddf858a71cc1edfb6e9
- https://github.com/flytohub/flyto-core
- https://github.com/flytohub/flyto-core/releases/tag/v2.26.7
- https://pypi.org/project/flyto-core
- https://github.com/advisories/GHSA-jx74-cqjv-2c67
CVE-2026-67426 · published · modified · JSON