Skip to content
AI Sec Watch
HighVulnerability

GHSA-hr7p-wg7r-hg9m: Flyto2 Core: ${env.VAR} interpolation reads any env secret despite env.get being denylisted

Source
GitHub Advisory(opens in a new tab)
Identifiers
CVE-2026-67427GHSA-hr7p-wg7r-hg9m
Published
Record updated
View JSON
Affected
  • flyto-core < 2.26.7
Fixed in
2.26.7
  • released July 7, 2026, 22 days before disclosure
Known exploitation
Not listed in the CISA Known Exploited Vulnerabilities catalog at the last check.
EPSS
0.4%

Summary

The capability policy denies the env.get and env.load_dotenv modules by default, but the workflow engine's variable resolver in src/core/engine/variable_resolver.py expands ${env.VAR} for any environment variable with no allowlist and no policy check. Because interpolation happens before module policy enforcement at BaseModule.run, a workflow parameter can read host secrets such as cloud keys and send them out through an allowed module, reachable via the workflow API and the MCP agent surface.

Mitigation

Suggested fix in the source: apply the same policy to ${env.*} as to the env.get module by gating it behind an explicit allowlist of permitted variable names and denying by default when env.get is denied; alternatively, drop ${env.*} and require env values to be passed explicitly at workflow start.

Related items