CVE-2026-67427
2 advisories.
PyPI/flyto-core CVE-2026-67427: high 8.6
Flyto2 Core: ${env.VAR} interpolation reads any env secret despite env.get being denylisted
Action: Upgrade flyto-core to 2.26.7 or later.
pip install flyto-core==2.26.7Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 2.26.7 | - |
Fixed versions
| 2.26.7 |
Sources
- osv: GHSA-hr7p-wg7r-hg9m
- https://github.com/flytohub/flyto-core/security/advisories/GHSA-hr7p-wg7r-hg9m
- https://nvd.nist.gov/vuln/detail/CVE-2026-67427
- https://github.com/flytohub/flyto-core/commit/d5f89d71303e3c1e6418d347c5c55fcd173cc8cc
- https://github.com/flytohub/flyto-core
- https://github.com/flytohub/flyto-core/releases/tag/v2.26.6
CVE-2026-67427 · published · modified · JSON
PyPI/flyto-core CVE-2026-67427: high 8.6
Flyto2 Core: ${env.VAR} interpolation reads any env secret despite env.get being denylisted
Action: Upgrade flyto-core to 2.26.7 or later.
pip install flyto-core==2.26.7Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 2.26.7 | - |
Fixed versions
| 2.26.7 |
Sources
- osv: PYSEC-2026-3570
- https://github.com/flytohub/flyto-core/security/advisories/GHSA-hr7p-wg7r-hg9m
- https://nvd.nist.gov/vuln/detail/CVE-2026-67427
- https://github.com/flytohub/flyto-core/commit/d5f89d71303e3c1e6418d347c5c55fcd173cc8cc
- https://github.com/flytohub/flyto-core
- https://github.com/flytohub/flyto-core/releases/tag/v2.26.6
- https://pypi.org/project/flyto-core
- https://github.com/advisories/GHSA-hr7p-wg7r-hg9m
CVE-2026-67427 · published · modified · JSON