VulnSocial

CVE-2026-67427Disclosure

LOWCVSS 8.6 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

Flyto2 Core is an execution kernel for automation and AI-agent workflows. Prior to 2.26.6, the workflow engine variable resolver expands ${env.VAR} for any host environment variable without an allowlist or capability policy check, allowing a workflow parameter to bypass the default capability policy denylist for env.get and env.load_dotenv and exfiltrate secrets through allowed modules. This issue is fixed in version 2.26.6.

Back to dashboard
0.0/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-522CWE-668CWE-693

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

STABLE

Threat summary

  • 2 mentions across 2 observed days
  • Momentum state: stable

What's happening

  • Technical details provided in 2 signals
  • Disclosure: 1 classified signal
  • General: 1 classified signal
  • Peaked 1d ago at 1 mentions (2026-07-29); latest day: 1
  • 2 total mentions across 2 days

Deep dive

Activity timeline2 mentions / 2d
00111Mentions · 2026-07-29: 1Mentions · 2026-07-30: 1Technical Details · 2026-07-29: 1Technical Details · 2026-07-30: 107-2907-30
Signal classification2 categories
Disclosure
150.0%
General
150.0%
Referenced assets2 URLs
Classification over time
DateTotalLabels
2026-07-291
Disclosure1
2026-07-301
General1
Full discourse2 posts
  • HOL@HashgraphOnline
    General

    flyto-core < 2.26.7 expands ${env.VAR} with no allowlist. env.get is denylisted to stop secret exfil, but this reads the same data (API keys, DSNs) into any workflow param, then exfils it. CVE-2026-67427 / GHSA-hr7p-wg7r-hg9m https://hol.org/guard/security/cves

    Post summary

    The post outlines a flaw in flyto‑core that could cause secret exfiltration through unfiltered environment variable expansion, but does not provide a PoC, exploit code, or patch guidance.

    420911.0K
    19.7K followersView on X
  • CVE@CVEnew
    Disclosure

    CVE-2026-67427 Flyto2 Core is an execution kernel for automation and AI-agent workflows. Prior to 2.26.6, the workflow engine variable resolver expands ${env.VAR} for any host envir… https://www.cve.org/CVERecord?id=CVE-2026-67427

    Post summary

    The text announces a CVE for Flyto2 Core, describing a flaw where the variable resolver expands ${env.VAR} for any host environment prior to 2.26.6, without providing PoC, exploit, or patch details.

    00000561
    57.9K followersView on X

Explore more

Back to dashboard