Technical impact
Flyto2 Core exposes a POST /run endpoint on 0.0.0.0 at port 8344 without requiring any authentication. The service accepts a user‑controlled callback_url, constructs an outbound POST to that URL, and attaches an X-Internal-Key header containing the internal runner secret. Because the code bypasses the target_allowed check, an attacker can craft the callback URL to point to any internal or external resource, enabling server‑side request forgery. Intercepting or manipulating the outbound request exposes the secret value, which can be leveraged to impersonate the worker or access protected resources. The vulnerability is classified as missing authentication (CWE‑306), credentials in plaintext (CWE‑522), and SSRF (CWE‑918).
Affected Systems
Impacted systems are installations of FlyTo Hub's FlyTo Core, specifically versions earlier than 2.26.7. The vulnerability exists within the standalone flyto‑verification service defined in src/core/verification_service.py. Any deployment that has that service enabled and bound to the default address is susceptible. Upgrading to release 2.26.7 or later removes the /run endpoint and corrects the authentication and callback handling logic.
Risk and Exploitability
The CVSS v3.1 score of 9.3 represents a critical severity, but the EPSS score is listed as less than 1%, indicating that exploitation is unlikely in the current threat landscape. The vulnerability is not referenced in CISA's Known Exploited Vulnerabilities catalog. An attacker can exercise the flaw from any system with network reach to the exposed port, which is typically the internet if firewall rules are not applied, making unauthenticated SSRF and secret exfiltration straightforward once the endpoint is accessible.
Github GHSA