THREATOPS

THREAT OPS › Threat News › [GHSA] GHSA-jx74-cqjv-2c67 (critical) — Flyto2 Core: Unauthenticated flyto-verification /run: callback_url SSRF and internal runner-secret exfiltration

[GHSA] GHSA-jx74-cqjv-2c67 (critical) — Flyto2 Core: Unauthenticated flyto-verification /run: callback_url SSRF and internal runner-secret exfiltration

highgithub_advisoriesPublished 2026-07-30

GHSA-jx74-cqjv-2c67 Severity: critical CVE: CVE-2026-67426

Flyto2 Core: Unauthenticated flyto-verification /run: callback_url SSRF and internal runner-secret exfiltration

## Summary The standalone `flyto-verification` service exposes `POST /run` with **no authentication**, on all interfaces (0.0.0.0:8344 per the shipped Dockerfile). The request body's `callback_url` is used verbatim for an outbo

Indicators of compromise

CVE-2026-67426cve
http://attacker.tld/collecturl

Original source: https://github.com/advisories/GHSA-jx74-cqjv-2c67