CVE-2026-67428: Anthropic Python SSRF

Q: Is CVE-2026-67428 actively exploited?

No confirmed active exploitation of CVE-2026-67428 has been reported, but organizations should still patch proactively.

Q: How to fix CVE-2026-67428?

Upgrade flyto-core to 2.26.7 or later immediately — this restores validate_url_with_env_config checks across all affected modules. If immediate upgrade isn't possible: (1) apply network-level egress controls (firewall/NACL) blocking the workflow runtime from reaching 169.254.169.254, RFC1918 ranges, and other internal-only CIDRs; (2) disable or gate access to the flagged modules (http.requests, http_get/http_post, graphql.query/mutation, monitor.http_check, the notification connectors, ai.vision_analyze, verify.visual_diff, browser.proxy_rotate, and agent/llm base_url overrides) behind admin-only workflow permissions; (3) if using IMDSv2 on AWS, enforce hop-limit restrictions to blunt SSRF-to-metadata paths. For detection, monitor outbound connection logs from flyto-core hosts/containers for requests to metadata IPs or unexpected internal hosts, and audit workflow definitions for URL parameters sourced from external/user input rather than static configuration.

Q: What systems are affected by CVE-2026-67428?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, LLM API integration, workflow orchestration.

Q: What is the CVSS score for CVE-2026-67428?

CVE-2026-67428 has a CVSS v3.1 base score of 8.5 (HIGH).

CISO Take

Flyto2 Core, an execution kernel for automation and AI-agent workflows, ships more than a dozen HTTP-emitting modules — including its raw HTTP client, GraphQL calls, Slack/Discord/Teams notifiers, visual-diff and browser-proxy tools, and critically the agent/LLM inline base_url branch — that fetch caller-controlled URLs without the library's own validate_url_with_env_config safeguard, enabling SSRF to internal services or cloud metadata endpoints. This warrants attention because of the blast radius: 6,037 downstream packages depend on flyto-core, the flaw requires only low privileges and no user interaction (CVSS 8.5, AV:N/AC:L/PR:L/UI:N), and the compromised LLM base_url path means an attacker can redirect what looks like a model API call to an internal admin endpoint or the instance metadata service. There is no evidence of active exploitation — it's not in CISA KEV, no EPSS score is published, and no public exploit or Nuclei template exists yet — but the low complexity and network reach make it easy to weaponize once noticed. Patch to flyto-core 2.26.7 immediately; until then, egress-filter outbound requests from the workflow runtime to RFC1918 ranges and 169.254.169.254, and audit logs for any of the named modules receiving attacker-influenced URL parameters. The 43 other CVEs already recorded against this package and its 31/100 risk score suggest this isn't an isolated lapse — treat flyto-core as a high-scrutiny dependency going forward.

Sources: NVD GitHub Advisory ATLAS

What is the risk?

High risk despite the absence of active exploitation signals. The vulnerability is trivially reachable (network vector, low complexity, no user interaction) and requires only low privileges, which in a multi-tenant or shared workflow-builder deployment could mean any authenticated workflow author. The confidentiality impact is high (metadata/internal service disclosure) with no direct integrity or availability impact, consistent with a classic SSRF profile. The lack of EPSS/KEV/public-exploit data means real-world exploitation likelihood is currently unmeasured rather than confirmed-low — this is a young CVE (published 2026-07-29) and detection tooling typically lags disclosure by weeks. The package's history of 43 prior CVEs and a package risk score of 31/100 indicate a pattern of security debt that should raise the priority of remediation beyond what this single CVE's metrics suggest in isolation.

How does the attack unfold?

Malicious workflow input

An attacker with low-privilege access to a Flyto2 workflow sets a caller-controlled URL parameter on an HTTP-emitting or LLM base_url module.

AML.T0049

Unvalidated SSRF fetch

The kernel executes the fetch without validate_url_with_env_config, reaching internal services or the cloud metadata endpoint instead of the intended destination.

AML.T0053

Credential/data harvesting

The response (e.g., IAM credentials from instance metadata, or internal API data) is returned into workflow output or logs, exposing it to the attacker.

AML.T0055

Follow-on compromise

Harvested credentials or internal access are used to pivot further into the cloud environment or internal network.

AML.T0075

Malicious workflow input

An attacker with low-privilege access to a Flyto2 workflow sets a caller-controlled URL parameter on an HTTP-emitting or LLM base_url module.

AML.T0049

Unvalidated SSRF fetch

The kernel executes the fetch without validate_url_with_env_config, reaching internal services or the cloud metadata endpoint instead of the intended destination.

AML.T0053

Credential/data harvesting

The response (e.g., IAM credentials from instance metadata, or internal API data) is returned into workflow output or logs, exposing it to the attacker.

AML.T0055

Follow-on compromise

Harvested credentials or internal access are used to pivot further into the cloud environment or internal network.

AML.T0075

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Anthropic Python	pip	<= 2.26.6	`2.26.7`
3.8K 6.0K dependents Pushed 6d ago 89% patched ~11d to patch Full package profile →

Do you use Anthropic Python? You're affected.

How severe is it?

CVSS 3.1

8.5 / 10

EPSS

N/A

Exploitation Status

No known exploitation

Sophistication

Moderate

What is the attack surface?

AV Network

AC Low

PR Low

UI None

S Changed

C High

I Low

A None

What should I do?

1 step

Upgrade flyto-core to 2.26.7 or later immediately — this restores validate_url_with_env_config checks across all affected modules. If immediate upgrade isn't possible: (1) apply network-level egress controls (firewall/NACL) blocking the workflow runtime from reaching 169.254.169.254, RFC1918 ranges, and other internal-only CIDRs; (2) disable or gate access to the flagged modules (http.requests, http_get/http_post, graphql.query/mutation, monitor.http_check, the notification connectors, ai.vision_analyze, verify.visual_diff, browser.proxy_rotate, and agent/llm base_url overrides) behind admin-only workflow permissions; (3) if using IMDSv2 on AWS, enforce hop-limit restrictions to blunt SSRF-to-metadata paths. For detection, monitor outbound connection logs from flyto-core hosts/containers for requests to metadata IPs or unexpected internal hosts, and audit workflow definitions for URL parameters sourced from external/user input rather than static configuration.

How is it classified?

Data Extraction Auth Bypass Agent API AML.T0049 - Exploit Public-Facing Application AML.T0053 - AI Agent Tool Invocation AML.T0055 - Unsecured Credentials AML.T0075 - Cloud Service Discovery

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, Robustness and Cybersecurity

ISO 42001

Annex A.6.2 - AI System Security in Operation

NIST AI RMF

MEASURE 2.7 - AI System Security and Resilience

OWASP LLM Top 10

LLM06 - Excessive Agency

Frequently Asked Questions

What is CVE-2026-67428?

Flyto2 Core, an execution kernel for automation and AI-agent workflows, ships more than a dozen HTTP-emitting modules — including its raw HTTP client, GraphQL calls, Slack/Discord/Teams notifiers, visual-diff and browser-proxy tools, and critically the agent/LLM inline base_url branch — that fetch caller-controlled URLs without the library's own validate_url_with_env_config safeguard, enabling SSRF to internal services or cloud metadata endpoints. This warrants attention because of the blast radius: 6,037 downstream packages depend on flyto-core, the flaw requires only low privileges and no user interaction (CVSS 8.5, AV:N/AC:L/PR:L/UI:N), and the compromised LLM base_url path means an attacker can redirect what looks like a model API call to an internal admin endpoint or the instance metadata service. There is no evidence of active exploitation — it's not in CISA KEV, no EPSS score is published, and no public exploit or Nuclei template exists yet — but the low complexity and network reach make it easy to weaponize once noticed. Patch to flyto-core 2.26.7 immediately; until then, egress-filter outbound requests from the workflow runtime to RFC1918 ranges and 169.254.169.254, and audit logs for any of the named modules receiving attacker-influenced URL parameters. The 43 other CVEs already recorded against this package and its 31/100 risk score suggest this isn't an isolated lapse — treat flyto-core as a high-scrutiny dependency going forward.

Is CVE-2026-67428 actively exploited?

No confirmed active exploitation of CVE-2026-67428 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-67428?

Upgrade flyto-core to 2.26.7 or later immediately — this restores validate_url_with_env_config checks across all affected modules. If immediate upgrade isn't possible: (1) apply network-level egress controls (firewall/NACL) blocking the workflow runtime from reaching 169.254.169.254, RFC1918 ranges, and other internal-only CIDRs; (2) disable or gate access to the flagged modules (http.requests, http_get/http_post, graphql.query/mutation, monitor.http_check, the notification connectors, ai.vision_analyze, verify.visual_diff, browser.proxy_rotate, and agent/llm base_url overrides) behind admin-only workflow permissions; (3) if using IMDSv2 on AWS, enforce hop-limit restrictions to blunt SSRF-to-metadata paths. For detection, monitor outbound connection logs from flyto-core hosts/containers for requests to metadata IPs or unexpected internal hosts, and audit workflow definitions for URL parameters sourced from external/user input rather than static configuration.

What systems are affected by CVE-2026-67428?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, LLM API integration, workflow orchestration.

What is the CVSS score for CVE-2026-67428?

CVE-2026-67428 has a CVSS v3.1 base score of 8.5 (HIGH).

What is the AI security impact?

Affected AI Architectures

agent frameworksLLM API integrationworkflow orchestration

MITRE ATLAS Techniques

AML.T0049 Exploit Public-Facing Application

AML.T0053 AI Agent Tool Invocation

AML.T0055 Unsecured Credentials

AML.T0075 Cloud Service Discovery

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: Annex A.6.2

NIST AI RMF: MEASURE 2.7

OWASP LLM Top 10: LLM06

What are the technical details?

Original Advisory

Flyto2 Core is an execution kernel for automation and AI-agent workflows. Prior to 2.26.7, HTTP-emitting modules including src/core/modules/third_party/developer/http/requests.py, core.api.http_get, core.api.http_post, graphql.query, graphql.mutation, monitor.http_check, communication.slack_send, notification.discord.send_message, notification.slack.send_message, notification.teams.send_message, ai.vision_analyze, verify.visual_diff, browser.proxy_rotate, and the agent and llm inline base_url branch fetch caller-controlled URLs without validate_url_with_env_config, allowing SSRF to internal or metadata endpoints. This issue is fixed in version 2.26.7.

Exploitation Scenario

An attacker with low-privilege access to a Flyto2-based workflow builder (e.g., a contributor who can create or edit automation workflows, or an indirect actor who can influence a workflow's stored URL parameter via an upstream integration) configures an HTTP-emitting node — say core.api.http_get or the agent/llm node's base_url override — to point at http://169.254.169.254/latest/meta-data/iam/security-credentials/<role> instead of the intended external endpoint. Because the module skips validate_url_with_env_config, the kernel executes the fetch server-side and returns the response into the workflow's output or logs, handing the attacker temporary IAM credentials for the host's cloud role. With those credentials, the attacker pivots to other cloud resources, or alternatively uses the same technique against an internal-only admin API to read or modify data the workflow host can reach but the attacker otherwise couldn't.

Weaknesses (CWE)

CWE-918 Server-Side Request Forgery (SSRF) Primary CWE-918 Server-Side Request Forgery (SSRF) Primary CWE-918 Server-Side Request Forgery (SSRF)

CWE-918 — Server-Side Request Forgery (SSRF): The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Source: MITRE CWE corpus.