CVE-2026-67427 Flyto2 Core: ${env.VAR} interpolation reads any env secret despite env.get being denylisted
Attackers can exfiltrate host environment secrets via workflow parameters, bypassing capability policy denylists in Flyto2 Core.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-67427?
CVE-2026-67427 is a high-severity vulnerability in flytohub flyto-core, published on 29 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Flyto2 Core is an execution kernel for automation and AI-agent workflows. Prior to 2.26.6, the workflow engine variable resolver expands ${env.VAR} for any host environment variable without an allowlist or capability policy check, allowing a workflow parameter to bypass the default capability policy denylist for env.get and env.load_dotenv and exfiltrate secrets through allowed modules. This issue is fixed in version 2.26.6.
Which versions are affected by CVE-2026-67427?
3 open source packages ship an affected version, including flyto-core.
| Package | Affected | Fixed in |
|---|---|---|
flyto-core PyPI | All versions | 2.26.7 |
flyto-core PyPI | All versions | 2.26.7 |
flyto-core PyPI | All versions | 2.26.7 |
How do I fix CVE-2026-67427?
Upgrade flyto-core to 2.26.7 or later.
Is CVE-2026-67427 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-67427 exists.
Sources
Also known as GHSA-hr7p-wg7r-hg9m, PYSEC-2026-3570.