Skip to content

v2.26.7 — Security release (SSRF hardening)

Choose a tag to compare

View all tags
@ChesterHsu ChesterHsu released this 08 Jul 01:17
Immutable release. Only release title and notes can be modified.
v2.26.7
9449def

Security release addressing three SSRF-family advisories reported via GitHub private vulnerability reporting. All users should upgrade from 2.26.6.

Security fixes

  • GHSA-jx74-cqjv-2c67 (Critical) — The flyto-verification /run endpoint was unauthenticated and forwarded a caller-controlled callback_url verbatim with the internal runner secret attached (unauthenticated SSRF + secret exfiltration). /run now requires a shared secret and fails closed; callbacks are SSRF-guarded and the internal key is only attached for trusted hosts.
  • GHSA-pgwh-4jj4-qm8v (High) — Several HTTP-emitting modules fetched client-controlled URLs without the SSRF guard their siblings apply. All now call the guard before issuing the request.
  • GHSA-c9hr-64h3-gxpc (High) — http.get/http.request/http.batch validated only the initial URL then followed redirects into internal space. Every redirect hop is now revalidated through the SSRF guard.

Upgrade

pip install --upgrade flyto-core==2.26.7

Reported by zx (Jace). See CHANGELOG.md for full details.

Assets 3
Loading