Skip to content

flytohub/flyto-core

v2.26.7 Security

This release includes 3 security fixes for security teams reviewing exposed deployments.

Published 19d MCP Developer Tools
✓ No known CVEs patched
Read the diff → Tool health → What is this tool? →
This release patches 3 known CVEs

Topics

ai-agents ai-tools atomic-modules automation browser-automation execution-engine
+13 more
flyto2 llm low-code mcp mcp-server model-context-protocol playwright python rpa security web-scraping workflow-automation workflow-engine

Affected surfaces

rce_ssrf breaking_upgrade

Summary

AI summary

Security release fixing three SSRF advisories affecting unauthenticated endpoint and HTTP modules.

Full changelog

Security release addressing three SSRF-family advisories reported via GitHub private vulnerability reporting. All users should upgrade from 2.26.6.

Security fixes

  • GHSA-jx74-cqjv-2c67 (Critical) — The flyto-verification /run endpoint was unauthenticated and forwarded a caller-controlled callback_url verbatim with the internal runner secret attached (unauthenticated SSRF + secret exfiltration). /run now requires a shared secret and fails closed; callbacks are SSRF-guarded and the internal key is only attached for trusted hosts.
  • GHSA-pgwh-4jj4-qm8v (High) — Several HTTP-emitting modules fetched client-controlled URLs without the SSRF guard their siblings apply. All now call the guard before issuing the request.
  • GHSA-c9hr-64h3-gxpc (High) — http.get/http.request/http.batch validated only the initial URL then followed redirects into internal space. Every redirect hop is now revalidated through the SSRF guard.

Upgrade

pip install --upgrade flyto-core==2.26.7

Reported by zx (Jace). See CHANGELOG.md for full details.

Security Fixes

  • [GHSA-jx74-cqjv-2c67] (Critical) – `/run` endpoint now requires shared secret, blocks unauthenticated SSRF and prevents internal runner secret exfiltration.
  • [GHSA-pgwh-4jj4-qm8v] (High) – All HTTP‑emitting modules now invoke the SSRF guard before fetching client‑controlled URLs.
  • [GHSA-c9hr-64h3-gxpc] (High) – Redirect hops for `http.get`, `http.request`, and `http.batch` are revalidated through the SSRF guard.
View diff on GitHub

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Share on X Share on Bluesky

Track flytohub/flyto-core

Get notified when new releases ship.

Sign up free

About flytohub/flyto-core

Deterministic execution engine for AI agents with 412 modules across 78 categories (browser, file, Docker, data, crypto, scheduling). Features execution trace, evidence snapshots, replay from any step, and supports both STDIO and Streamable HTTP transport.

All releases →

Related context

Beta — feedback welcome: [email protected]