AI Sec Watch: A Security Intelligence Platform for AI Systems

Luu, T.J.

GHSA-hr7p-wg7r-hg9m: Flyto2 Core: ${env.VAR} interpolation reads any env secret despite env.get being denylisted

highvulnerabilityLLM-Specific

security

Source: GitHub Advisory DatabaseJuly 30, 2026CVE-2026-67427

Summary

Flyto2 Core has a security bypass where the variable resolver can read any environment variable using `${env.VAR}` syntax, even though the `env.get` module (which does the same thing) is blocked by the capability policy (a security control that restricts which modules a workflow can use). This means attackers can steal secrets like API keys by embedding `${env.SECRET}` in workflow parameters and sending them to external URLs.

Solution / Mitigation

The source suggests two fixes: (1) Apply the same policy to `${env.*}` as to the `env.get` module by gating it behind an explicit allowlist of permitted variable names and denying by default when `env.get` is denied, so engine interpolation and module execution enforce one env-access policy, or (2) drop `${env.*}` entirely and require env values to be passed in explicitly at workflow start.