Prior to 2.26.6, Flyto2 Core’s llm.chat component reads LLM provider keys such as OPENAI_API_KEY and ANTHROPIC_API_KEY from environment variables and includes them in the Authorization: Bearer header when forwarding a request to the caller‑controlled base_url. An attacker who controls the base_url can thus receive the operator’s API key on a public host that bypasses the SSRF guard, enabling the attacker to impersonate the operator and misuse the credentials. This disclosure of sensitive authentication information represents a confidentiality compromise. The weakness is identified as CWE‑201 (Information Exposure) and CWE‑522 (Missing Authentication for Privileged Access).

This flaw affects FlytoHub’s Flyto Core component for all versions preceding 2.26.6. The vendor is flytohub and the affected product is the flyto-core kernel used to run automation and AI‑agent workflows. No specific sub‑product or module versions are listed beyond the pre‑2.26.6 baseline.

The CVSS score of 8.6 indicates a high severity D‑score, reflecting the significant impact of credential leakage. The EPSS score of less than 1% suggests a very low exploitation likelihood in the current posture, and the vulnerability is not listed in CISA’s KEV catalog. The attack requires an attacker to supply a rogue base_url that passes the SSRF guard and to have the vulnerable application use that URL; once the request is made, the API key is transmitted in plain form. Therefore, the risk is primarily the exposure of highly sensitive credentials, but the exploitation conditions are narrow and mitigated by proper host whitelisting or disabling the feature if not needed.