Unauthenticated SSRF and Runner-Secret Exfiltration in flyto-core's flyto-verification Service (CVE-2026-67426)

A newly published GitHub Security Advisory (GHSA-jx74-cqjv-2c67) discloses a critical (CVSS 9.3) vulnerability in flyto-core's standalone flyto-verification service, tracked as CVE-2026-67426. According to the advisory, the service's POST /run endpoint ships with no authentication and, per the project's own Dockerfile, binds to 0.0.0.0:8344 by default. The request body accepts a callback_url field that is used verbatim for an outbound callback POST, and that callback unconditionally attaches an X-Internal-Key header containing the FLYTO_RUNNER_SECRET environment variable. The advisory states that the service's existing allowlist (target_allowed) only inspects params.target_url and never validates callback_url, and that no SSRF guard is applied to it at all. A proof-of-concept in the advisory shows a single unauthenticated request causing the service to POST attacker-controlled data — plus the internal secret — to an attacker-supplied host.

Why It Matters

Per the advisory, this affects flyto-core versions up to and including 2.26.6 wherever the flyto-verification service is deployed with default settings. Two distinct impacts are described: first, unauthenticated server-side request forgery, which could be pointed at internal services or cloud metadata endpoints with an attacker-controlled JSON body; second, exfiltration of the FLYTO_RUNNER_SECRET to an attacker-controlled destination, which the advisory notes could then be replayed to forge authenticated callbacks to the real engine. Because no authentication is required and the service is described as binding all interfaces by default, any deployment following the shipped Dockerfile configuration and reachable over the network is potentially exposed. The advisory lists the exploit status as proof-of-concept public, so working exploitation details are already available.

What Defenders Should Do Now

• Identify any internet- or network-reachable instances of the flyto-verification service (default port 8344) and restrict access — ideally binding to loopback only, as the advisory recommends, until patched.
• Treat the FLYTO_RUNNER_SECRET as potentially compromised on any exposed instance; rotate it and audit for unexpected callback traffic to that engine.
• Hunt for outbound HTTP requests from hosts running this service to unfamiliar or attacker-controlled destinations, particularly ones carrying an X-Internal-Key header.
• Watch for inbound requests to internal/cloud-metadata addresses originating from the verification service's network context, which would indicate SSRF attempts via the callback_url parameter.
• Apply the vendor's suggested mitigations once available: authentication on /run, SSRF/allowlist validation applied to callback_url, and refusal to attach the internal header to non-allowlisted destinations.

This is developing, net-new intelligence based solely on the GitHub Security Advisory published today; patch availability and further vendor guidance should be confirmed directly from the source. See the original advisory for full technical details: GHSA-jx74-cqjv-2c67.