This release includes 4 security fixes for security teams reviewing exposed deployments.
Topics
+13 more
Affected surfaces
ReleasePort's take
Moderate signalThe v2.26.8 security release fixes arbitrary file write, SSRF, and path traversal vulnerabilities across multiple modules.
Why it matters: Addresses high‑severity issues (severity 90 for file write) affecting file.*, http.paginate, outbound HTTP, and MCP functions; operators should upgrade immediately to mitigate exploitation risk.
Summary
AI summarySecurity release fixing five advisories including arbitrary file write, SSRF vulnerabilities, and path traversal.
Changes in this release
| Type | Severity | Summary | CVE |
|---|---|---|---|
| Security | Critical |
Fixes arbitrary file write vulnerability in all 8 file-writing modules. Fixes arbitrary file write vulnerability in all 8 file-writing modules. Source: llm_adapter@2026-07-15 Confidence: high |
— |
| Security | High |
Mitigates second-order SSRF in http.paginate by revalidating follow-up URLs. Mitigates second-order SSRF in http.paginate by revalidating follow-up URLs. Source: llm_adapter@2026-07-15 Confidence: high |
— |
| Security | High |
Addresses DNS‑rebinding SSRF by pinning validated IP in outbound modules. Addresses DNS‑rebinding SSRF by pinning validated IP in outbound modules. Source: llm_adapter@2026-07-15 Confidence: high |
— |
| Security | Medium |
Prevents path traversal in MCP run_recipe by confining load_recipe() to bundled recipes directory. Prevents path traversal in MCP run_recipe by confining load_recipe() to bundled recipes directory. Source: llm_adapter@2026-07-15 Confidence: high |
— |
Full changelog
Security release fixing 5 advisories (all confined to v<=2.26.7):
- GHSA-p34x-fmph-9fjx (Critical) — arbitrary file write via unguarded
data.*/file.*modules (incomplete fix of GHSA-2956). All 8 file-writing modules now confine toFLYTO_SANDBOX_DIR. - GHSA-2mr3-rxrq-238c (High) — second-order SSRF in
http.paginatevia unvalidatedLink: rel="next". Follow-up URLs are now SSRF-revalidated. - GHSA-pfg2-w999-497v (High) / GHSA-6pm8-6f34-9v3g (Medium) — DNS-rebinding SSRF (resolve-then-connect TOCTOU). Outbound modules now pin the validated IP via a guarded aiohttp resolver.
- GHSA-mxcc-cr6x-2mvr (Medium) — path traversal in MCP
run_recipe.load_recipe()confines to the bundled recipes dir.
See CHANGELOG.md for detail. pip install --upgrade flyto-core (2.26.8 on PyPI).
Security Fixes
- GHSA-p34x-fmph-9fjx (Critical) — arbitrary file write via unguarded `data.*`/`file.*` modules fixed by confining writes to `FLYTO_SANDBOX_DIR`.
- GHSA-2mr3-rxrq-238c (High) — second‑order SSRF in `http.paginate` mitigated by revalidating follow‑up URLs.
- GHSA-pfg2-w999-497v (High) / GHSA-6pm8-6f34-9v3g (Medium) — DNS‑rebinding SSRF fixed by pinning validated IP via guarded aiohttp resolver.
- GHSA-mxcc-cr6x-2mvr (Medium) — path traversal in MCP `run_recipe` resolved by confining `load_recipe()` to the bundled recipes directory.
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
About flytohub/flyto-core
Deterministic execution engine for AI agents with 412 modules across 78 categories (browser, file, Docker, data, crypto, scheduling). Features execution trace, evidence snapshots, replay from any step, and supports both STDIO and Streamable HTTP transport.
Related context
Beta — feedback welcome: [email protected]