https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 28 Sep 2026 08:10:24 +0000 https://db.gcve.eu/vuln/cve-2026-67427 <p><strong>Affected:</strong> flytohub flyto-core</p> <p>Flyto2 Core is an execution kernel for automation and AI-agent workflows. Prior to 2.26.6, the workflow engine variable resolver expands ${env.VAR} for any host environment variable without an allowlist or capability policy check, allowing a workflow parameter to bypass the default capability policy denylist for env.get and env.load_dotenv and exfiltrate secrets through allowed modules. This issue is fixed in version 2.26.6.</p> <p><strong>Affected:</strong> flytohub flyto-core</p> <p>Flyto2 Core is an execution kernel for automation and AI-agent workflows. Prior to 2.26.6, the workflow engine variable resolver expands ${env.VAR} for any host environment variable without an allowlist or capability policy check, allowing a workflow parameter to bypass the default capability policy denylist for env.get and env.load_dotenv and exfiltrate secrets through allowed modules. This issue is fixed in version 2.26.6.</p> https://db.gcve.eu/vuln/cve-2026-67427 https://db.gcve.eu/vuln/ghsa-hr7p-wg7r-hg9m <p><strong>Affected:</strong> PyPI: flyto-core</p> <p>## Summary</p> <p>The capability policy denies the `env.get` and `env.load_dotenv` modules by default, with the stated reason that they read arbitrary host environment variables (API keys, DSNs) and are a secret-exfil risk. But the workflow engine&#39;s variable resolver expands `${env.VAR}` for any environment variable with no allowlist and no policy check, so the exact capability the denylist blocks is available to any workflow parameter. The resolved secret can then be sent out through any allowed module.</p> <p>## Affected code</p> <p>`src/core/engine/variable_resolver.py`:</p> <p>```python if var_type == &#39;env&#39;: if len(parts) &lt; 2: return None env_var = parts[1] return os.getenv(env_var) # any env var, no allowlist, not covered by module policy ```</p> <p>The module policy (`enforce_module_policy` in `module_policy.py`) gates module execution at `BaseModule.run`, but `${...}` interpolation happens earlier in the engine and is not subject to it. So denylisting `env.get` does not actually stop a workflow from reading host env secrets.</p> <p>## Reproduction</p> <p>Save as `envbypass_poc.py`, run with `PYTHONPATH=src/src python envbypass_poc.py`.</p> <p>```python #!/usr/bin/env python3 import os os.environ[&#34;AWS_SECRET_ACCESS_KEY&#34;] = &#34;AKIA-operator-super-secret-DO-NOT-LEAK&#34;</p> <p>from core.module_policy import module_filter from core.engine.variable_resolver import VariableResolver</p> <p>print(&#34;env.get allowed? &#34;, module_filter.is_allowed(&#34;env.get&#34;)) r = VariableResolver(params={}, context={}) print(&#34;resol…</p> <p><strong>Affected:</strong> PyPI: flyto-core</p> <p>## Summary</p> <p>The capability policy denies the `env.get` and `env.load_dotenv` modules by default, with the stated reason that they read arbitrary host environment variables (API keys, DSNs) and are a secret-exfil risk. But the workflow engine&#39;s variable resolver expands `${env.VAR}` for any environment variable with no allowlist and no policy check, so the exact capability the denylist blocks is available to any workflow parameter. The resolved secret can then be sent out through any allowed module.</p> <p>## Affected code</p> <p>`src/core/engine/variable_resolver.py`:</p> <p>```python if var_type == &#39;env&#39;: if len(parts) &lt; 2: return None env_var = parts[1] return os.getenv(env_var) # any env var, no allowlist, not covered by module policy ```</p> <p>The module policy (`enforce_module_policy` in `module_policy.py`) gates module execution at `BaseModule.run`, but `${...}` interpolation happens earlier in the engine and is not subject to it. So denylisting `env.get` does not actually stop a workflow from reading host env secrets.</p> <p>## Reproduction</p> <p>Save as `envbypass_poc.py`, run with `PYTHONPATH=src/src python envbypass_poc.py`.</p> <p>```python #!/usr/bin/env python3 import os os.environ[&#34;AWS_SECRET_ACCESS_KEY&#34;] = &#34;AKIA-operator-super-secret-DO-NOT-LEAK&#34;</p> <p>from core.module_policy import module_filter from core.engine.variable_resolver import VariableResolver</p> <p>print(&#34;env.get allowed? &#34;, module_filter.is_allowed(&#34;env.get&#34;)) r = VariableResolver(params={}, context={}) print(&#34;resol…</p> https://db.gcve.eu/vuln/ghsa-hr7p-wg7r-hg9m