Why it matters
Together these vulnerabilities allow an attacker who can influence a Flyto2 workflow (e.g., via untrusted input to an agent tool) to escape the sandbox confinement entirely, exfiltrate LLM provider API keys and other secrets from the host environment, and pivot into internal networks via SSRF — a near-complete breakdown of the isolation model an AI-agent execution kernel is supposed to provide.
Attack vector
A cluster of six related CVEs disclosed together in flyto-core: CVE-2026-67429 (arbitrary file write via image.download bypassing FLYTO_SANDBOX_DIR confinement), CVE-2026-67426 (unauthenticated flyto-verification /run endpoint with SSRF and internal secret exfiltration via callback_url), CVE-2026-67425 (LLM/API keys such as OPENAI_API_KEY leaked to attacker-controlled base_url), CVE-2026-67427 (${env.VAR} interpolation bypasses capability-policy allowlisting to read any host secret), and CVE-2026-67424/67428 (HTTP modules follow redirects/emit requests without re-validating against SSRF guards).
Affected systems
flyto-core (pip) prior to 2.26.6/2.26.7, multiple modules
Mitigation
Upgrade to flyto-core 2.26.6/2.26.7 or later per the GitHub commits; audit workflow configurations for reliance on output_dir, base_url, or ${env.VAR} interpolation from untrusted sources.