Flyto2 Core is an execution kernel for automation and AI-agent workflows. Prior to 2.26.6, the workflow engine variable resolver expands ${env.VAR} for any host environment variable without an allowlist or capability policy check, allowing a workflow parameter to bypass the default capability policy denylist for env.get and env.load_dotenv and exfiltrate secrets through allowed modules. This issue is fixed in version 2.26.6.
Attack Parameters
Attack Vector
Network
Can be exploited remotely
Attack Complexity
Low
Easy to exploit
Privileges Required
None
No privileges needed
User Interaction
None
No user interaction needed
Impact Assessment
Confidentiality
High
Complete data leak
Integrity
None
No data modification
Availability
None
No disruption
CVSS Vector v3.1
Weakness Type (CWE)
References 3
https://github.com/flytohub/flyto-core/commit/d5f89d71303e3c1e6418d347c5c55fcd1…
security-advisories@github.com
https://github.com/flytohub/flyto-core/releases/tag/v2.26.6
security-advisories@github.com
https://github.com/flytohub/flyto-core/security/advisories/GHSA-hr7p-wg7r-hg9m
security-advisories@github.com