CVE-2026-67424: Server-Side Request Forgery Bypass via Unvalidated Redirects in Flyto2 Core

The Flyto2 Core engine is designed to execute automation and artificial intelligence workflows by exposing dynamic orchestration modules. Under normal operational patterns, users utilize modules such as http.get, http.request, and http.batch to retrieve remote resources or execute webhooks. Because these execution runners operate on the internal network boundary of the host system, they expose a highly sensitive network attack surface.

To restrict access to internal infrastructure, the application uses an SSRF guard mechanism named validate_url_with_env_config(url). This validation tool resolves hostnames and asserts that target destinations do not lie within loopback addresses, local network subnets, or metadata addresses. If a user supplies a protected address directly, the application throws an exception and halts execution.

However, a severe design gap exists in how the engine processes downstream network redirections. While the initial request destination undergoes validation, intermediate HTTP redirection targets do not. This vulnerability allows an external, untrusted target to pivot the execution runner into restricted subnets by responding with standard redirection status codes.

The primary logical failure resides in the configuration of the Python aiohttp HTTP client library used by the request modules. When initializing execution sessions, the application relies on the default network client behavior where the redirect policy is configured with automatic redirection enabled (allow_redirects=True). Consequently, the socket handling layer resolves the redirection at the socket layer without returning control to the parent validation application.

The sequential flaw unfolds when an execution session resolves a public hostname that points to a legitimate external address. The application resolves the target host, verifies it does not match internal IP blocks, and initiates the socket connection. When the external server responds with a redirection status code (such as HTTP 301, 302, 303, 307, or 308) and a Location header, the underlying client immediately executes the subsequent request.

Because the redirection handling occurs transparently within the client library, the application-level validation layer is completely bypassed. If the Location header points to a private loopback target (such as http://127.0.0.1:8500) or cloud instance metadata endpoints (such as http://169.254.169.254/latest/meta-data), the client will establish the socket connection, retrieve the data, and expose internal configuration files or credential secrets.

The remediation committed in version 2.26.7 focuses on modifying the redirection behavior within src/core/utils.py. The patch explicitly disables automatic redirection on the HTTP client library and replaces it with a manual hop-by-hop checking loop.

# Patched implementation of aiohttp wrapper
_REDIRECT_STATUSES = frozenset({301, 302, 303, 307, 308})
 
async def guarded_aiohttp_request(session, method: str, url: str, *,
                                  max_redirects: int = 5, **kwargs):
    from urllib.parse import urljoin
    # Explicitly remove allow_redirects if passed by the caller
    kwargs.pop('allow_redirects', None)
    guard = ssrf_protection_enabled()
    if guard:
        # Validate the initial URL input
        validate_url_with_env_config(url)
    method = method.upper()
    for hop in range(max_redirects + 1):
        # Execute request with automatic redirection disabled
        response = await session.request(method, url, allow_redirects=False, **kwargs)
        location = response.headers.get('Location')
        
        # Manually intercept redirection status
        if response.status in _REDIRECT_STATUSES and location and hop < max_redirects:
            response.release()  # Prevent connection socket leakage
            url = urljoin(url, location)
            if guard:
                # REVALIDATE EACH INTERMEDIATE HOP AGAINST THE GUARD POLICY
                validate_url_with_env_config(url)
            if response.status == 303:
                method = 'GET'
                kwargs.pop('json', None)
                kwargs.pop('data', None)
            continue
        return response
    return response

By disabling automatic redirects at the library layer via allow_redirects=False, the application intercepts every redirect. The code resolves relative URLs using urljoin and evaluates the resolved URL string against validate_url_with_env_config(url). If any redirect hop target maps to a restricted IP address range, the system raises an SSRFError, terminating the connection.

An attacker with privileges to configure or trigger a workflow block can exploit this vulnerability to extract confidential credentials from cloud environments. The target runner environment must have access to the internal network space or a cloud metadata endpoint.

To conduct the attack, the adversary registers an external domain and configures it to return redirection response headers pointing to the targeted internal service. For example, a redirect script running on an external server can respond with:

HTTP/1.1 302 Found
Location: http://169.254.169.254/latest/meta-data/iam/security-credentials/admin-role

When the Flyto2 Core engine initiates the execution of the workflow block containing the external URL, the initial validation check resolves the domain to a public IP. The request proceeds, gets redirected, and because of automatic redirect tracking, queries the cloud metadata endpoint, returning the administrative AWS credentials to the attacker inside the workflow output logs.

The impact of this SSRF bypass is rated high (CVSS v3.1 base score of 8.5). Successful exploitation allows authenticated users with execution privileges to read arbitrary internal configurations, network service responses, database details, and cloud metadata records.

By obtaining access to loopback interfaces, an attacker can exploit other unauthenticated services residing on the local host. For example, local microservices, caches, and queue systems that assume safety within the network perimeter can be read and manipulated. Furthermore, in containerized environments, attackers can pull access tokens belonging to the Kubernetes node or host instance, enabling lateral movement and escalating privileges across the broader cluster deployment.

The recommended remediation is to immediately update flyto-core to version 2.26.7 or later. This upgrade deploys the custom request handler that manually checks and isolates redirection hops.

In addition to upgrading, security operators should implement host-level network egress restrictions. Restricting runner instances from accessing local subnets (such as 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) and blocklisting the cloud metadata address (169.254.169.254) via firewall rules (such as iptables or security groups) establishes a defense-in-depth model that prevents exploitation even in the presence of library-level validation bypasses.