https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 28 Sep 2026 08:10:19 +0000 https://db.gcve.eu/vuln/cve-2026-67424 <p><strong>Affected:</strong> flytohub flyto-core</p> <p>Flyto2 Core is an execution kernel for automation and AI-agent workflows. Prior to 2.26.7, the HTTP modules http.get, http.request, and http.batch in src/core/modules/atomic/http/get.py, src/core/modules/atomic/http/request.py, and src/core/modules/atomic/http/batch.py validate only the initial URL, then follow redirects with allow_redirects=True and without per-hop Location revalidation, allowing a public URL to redirect into internal address space and return the internal response body. This issue is fixed in version 2.26.7.</p> <p><strong>Affected:</strong> flytohub flyto-core</p> <p>Flyto2 Core is an execution kernel for automation and AI-agent workflows. Prior to 2.26.7, the HTTP modules http.get, http.request, and http.batch in src/core/modules/atomic/http/get.py, src/core/modules/atomic/http/request.py, and src/core/modules/atomic/http/batch.py validate only the initial URL, then follow redirects with allow_redirects=True and without per-hop Location revalidation, allowing a public URL to redirect into internal address space and return the internal response body. This issue is fixed in version 2.26.7.</p> https://db.gcve.eu/vuln/cve-2026-67424 https://db.gcve.eu/vuln/ghsa-c9hr-64h3-gxpc <p><strong>Affected:</strong> PyPI: flyto-core</p> <p>## Summary The HTTP modules that DO call the SSRF guard (`http.get`, `http.request`, `http.batch`) validate only the initial URL, then issue the request with aiohttp&#39;s default `allow_redirects=True` and perform no per-hop revalidation. An attacker hosts a public URL that 302-redirects to an internal address; the guard passes on the public host and aiohttp transparently follows the redirect into internal space, returning the internal body.</p> <p>## Root Cause `src/core/modules/atomic/http/get.py:116` calls `session.get(url, ...)` with no `allow_redirects` argument → aiohttp default `True`. `request.py:60` sets `allow_redirects=follow_redirects` (default True at :327); `batch.py:57` likewise. A repo grep of `http/` for `on_request_redirect` / `response.history` returns NONE — there is no redirect interception or Location revalidation.</p> <p>## Impact Full readable SSRF that defeats the primary SSRF control on the very modules that correctly validate. Confidentiality of internal/metadata responses (C:H), S:C.</p> <p>## Proof of Concept Verified live: `http.get` with allowlisted base `127.0.0.1` followed a `302 Location: http://127.0.0.2/...` (non-allowlisted) and returned `INTERNAL-VIA-REDIRECT`. ``` attacker hosts http://attacker.tld/r -&gt; 302 Location: http://&lt;cloud-metadata-ip&gt;/latest/meta-data/... execute_module http.get {&#34;url&#34;:&#34;http://attacker.tld/r&#34;} ```</p> <p>## Attack Chain 1. Entry: `execute_module http.get {url:&#34;http://attacker.tld/r&#34;}` (attacker 302-&gt;internal). Guard: `validate_url_with…</p> <p><strong>Affected:</strong> PyPI: flyto-core</p> <p>## Summary The HTTP modules that DO call the SSRF guard (`http.get`, `http.request`, `http.batch`) validate only the initial URL, then issue the request with aiohttp&#39;s default `allow_redirects=True` and perform no per-hop revalidation. An attacker hosts a public URL that 302-redirects to an internal address; the guard passes on the public host and aiohttp transparently follows the redirect into internal space, returning the internal body.</p> <p>## Root Cause `src/core/modules/atomic/http/get.py:116` calls `session.get(url, ...)` with no `allow_redirects` argument → aiohttp default `True`. `request.py:60` sets `allow_redirects=follow_redirects` (default True at :327); `batch.py:57` likewise. A repo grep of `http/` for `on_request_redirect` / `response.history` returns NONE — there is no redirect interception or Location revalidation.</p> <p>## Impact Full readable SSRF that defeats the primary SSRF control on the very modules that correctly validate. Confidentiality of internal/metadata responses (C:H), S:C.</p> <p>## Proof of Concept Verified live: `http.get` with allowlisted base `127.0.0.1` followed a `302 Location: http://127.0.0.2/...` (non-allowlisted) and returned `INTERNAL-VIA-REDIRECT`. ``` attacker hosts http://attacker.tld/r -&gt; 302 Location: http://&lt;cloud-metadata-ip&gt;/latest/meta-data/... execute_module http.get {&#34;url&#34;:&#34;http://attacker.tld/r&#34;} ```</p> <p>## Attack Chain 1. Entry: `execute_module http.get {url:&#34;http://attacker.tld/r&#34;}` (attacker 302-&gt;internal). Guard: `validate_url_with…</p> https://db.gcve.eu/vuln/ghsa-c9hr-64h3-gxpc