{"data":{"id":"384dab13-55a2-4883-8b98-932de17f9a02","title":"GHSA-hr7p-wg7r-hg9m: Flyto2 Core: ${env.VAR} interpolation reads any env secret despite env.get being denylisted","summary":"Flyto2 Core has a security bypass where the variable resolver can read any environment variable using `${env.VAR}` syntax, even though the `env.get` module (which does the same thing) is blocked by the capability policy (a security control that restricts which modules a workflow can use). This means attackers can steal secrets like API keys by embedding `${env.SECRET}` in workflow parameters and sending them to external URLs.","solution":"The source suggests two fixes: (1) Apply the same policy to `${env.*}` as to the `env.get` module by gating it behind an explicit allowlist of permitted variable names and denying by default when `env.get` is denied, so engine interpolation and module execution enforce one env-access policy, or (2) drop `${env.*}` entirely and require env values to be passed in explicitly at workflow start.","labels":["security"],"sourceUrl":"https://github.com/advisories/GHSA-hr7p-wg7r-hg9m","publishedAt":"2026-07-30T14:47:01.000Z","cveId":"CVE-2026-67427","cweIds":null,"cvssScore":null,"cvssSeverity":"high","severity":"high","attackType":["pii_leakage"],"issueType":"vulnerability","affectedPackages":["flyto-core@< 2.26.7 (fixed: 2.26.7)"],"affectedVendors":[],"affectedVendorsRaw":["Flyto2"],"classifierModel":"claude-haiku-4-5-20251001","classifierPromptVersion":"v3","cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.00339,"patchAvailable":true,"disclosureDate":"2026-07-30T14:47:01.000Z","capecIds":null,"crossRefCount":0,"attackSophistication":"moderate","impactType":["confidentiality","integrity"],"aiComponentTargeted":"agent","llmSpecific":true,"classifierConfidence":0.92,"researchCategory":null,"atlasIds":null}}