What happened
NVD published six related CVEs for Flyto2 Core on 2026-07-29 (CVE-2026-67429, -67426, -67425, -67427, -67424, -67428), collectively describing sandbox escape via path confinement bypass, an unauthenticated internal RPC endpoint, LLM provider API key exfiltration via SSRF, and unrestricted environment-variable exposure in an AI-agent workflow execution kernel.
Why it matters
Flyto2 Core is explicitly built as an execution kernel for AI-agent workflows — a single compromised or malicious workflow parameter can escape the sandbox, exfiltrate the LLM provider credentials the agent uses (OpenAI/Anthropic keys), and pivot to internal services, representing a near-complete agent-platform compromise chain rather than an isolated flaw.
Attack vector
Multiple chained vectors: (1) image.download and file-writing modules use caller-controlled output_dir instead of the FLYTO_SANDBOX_DIR confinement check, allowing attacker-controlled response bytes to be written outside the sandbox (CVE-2026-67429, CVSS 10.0); (2) the standalone verification service exposes an unauthenticated POST /run on 0.0.0.0:8344 with a client-supplied callback_url used for an outbound POST carrying an internal key (CVE-2026-67426, CVSS 9.3); (3) llm.chat leaks OPENAI_API_KEY/ANTHROPIC_API_KEY to a caller-controlled base_url via SSRF (CVE-2026-67425, CVSS 8.6); (4) the workflow variable resolver expands ${env.VAR} for any host environment variable without an allowlist, bypassing capability policy (CVE-2026-67427, CVSS 8.6); (5)/(6) HTTP-emitting modules only validate the initial URL, not redirect targets, enabling SSRF via redirect chains (CVE-2026-67424 / CVE-2026-67428, CVSS 8.5 each).
Affected systems
Flyto2 Core (flyto-core) — prior to 2.26.6 / 2.26.7 depending on component
Mitigation
Upgrade to flyto-core 2.26.6 or 2.26.7 depending on affected module; audit any exposed verification-service ports and environment-variable exposure to workflows.