Summary
Flyto2 Core's llm.chat component previously sent environment-derived API keys (e.g., OPENAI_API_KEY, ANTHROPIC_API_KEY) as Authorization headers to caller-controlled base URLs.
When an attacker can influence the base_url and route requests through a host that passes SSRF guards, they may receive the operator's secret provider keys and reuse them outside the intended environment.
Flyto2 Core's llm.chat component previously sent environment-derived API keys (e.g., OPENAI_API_KEY, ANTHROPIC_API_KEY) as Authorization headers to caller-controlled base URLs.
When an attacker can influence the base_url and route requests through a host that passes SSRF guards, they may receive the operator's secret provider keys and reuse them outside the intended environment.
Affected context
This vulnerability arises in Flyto2 Core deployments where:
- The llm.chat workflow step reads provider API keys from environment variables
- Downstream HTTP calls use a base_url that is directly influenced or controlled by the workflow caller or upstream data
- SSRF guards focus on URL patterns or IP ranges, but do not treat Authorization headers containing secrets as untrusted data
In such configurations, outbound requests may inadvertently send long-lived API credentials to external hosts.
This vulnerability arises in Flyto2 Core deployments where:
- The llm.chat workflow step reads provider API keys from environment variables
- Downstream HTTP calls use a base_url that is directly influenced or controlled by the workflow caller or upstream data
- SSRF guards focus on URL patterns or IP ranges, but do not treat Authorization headers containing secrets as untrusted data
In such configurations, outbound requests may inadvertently send long-lived API credentials to external hosts.
Exploit preconditions
- Attack surface: Outbound HTTP requests initiated by llm.chat within Flyto2 Core workflows.
- Required access: Ability to control or significantly influence the base_url parameter used by llm.chat.
- Trigger point: Execution of a workflow that causes llm.chat to perform a request with Authorization: Bearer set to an environment API key.
- Why exploitation is possible: The design assumes provider keys can be safely reused as generic Authorization tokens and does not distinguish between trusted endpoints and caller-controlled URLs, leading to secrets being attached to untrusted requests.
- Attack surface: Outbound HTTP requests initiated by llm.chat within Flyto2 Core workflows.
- Required access: Ability to control or significantly influence the base_url parameter used by llm.chat.
- Trigger point: Execution of a workflow that causes llm.chat to perform a request with Authorization: Bearer set to an environment API key.
- Why exploitation is possible: The design assumes provider keys can be safely reused as generic Authorization tokens and does not distinguish between trusted endpoints and caller-controlled URLs, leading to secrets being attached to untrusted requests.
Why this happens
The core issue is a misuse of sensitive configuration data as generic authentication material for arbitrary HTTP calls.
Environment variables holding provider secrets (e.g., OPENAI_API_KEY) are directly injected into the Authorization header for requests whose destination URL can be caller-controlled.
This maps to CWE-201: Insertion of Sensitive Information Into Sent Data and CWE-522: Insufficiently Protected Credentials, as the system fails to confine the use of credentials to verified endpoints and treats them as regular request metadata instead of high-risk secrets.
The core issue is a misuse of sensitive configuration data as generic authentication material for arbitrary HTTP calls.
Environment variables holding provider secrets (e.g., OPENAI_API_KEY) are directly injected into the Authorization header for requests whose destination URL can be caller-controlled.
This maps to CWE-201: Insertion of Sensitive Information Into Sent Data and CWE-522: Insufficiently Protected Credentials, as the system fails to confine the use of credentials to verified endpoints and treats them as regular request metadata instead of high-risk secrets.
Potential impact
- An attacker may obtain long-lived API keys for LLM providers and use them outside the operator's infrastructure.
- Attackers could perform unauthorized API calls, consuming quota and incurring financial cost.
- Stolen keys can be abused to exfiltrate or infer sensitive model usage data or prompts in other contexts.
- Compromised credentials may facilitate broader account takeover or abuse of associated cloud resources.
- An attacker may obtain long-lived API keys for LLM providers and use them outside the operator's infrastructure.
- Attackers could perform unauthorized API calls, consuming quota and incurring financial cost.
- Stolen keys can be abused to exfiltrate or infer sensitive model usage data or prompts in other contexts.
- Compromised credentials may facilitate broader account takeover or abuse of associated cloud resources.
General mitigation guidance
Mitigation should focus on strict isolation and controlled use of secrets:
- Limit the use of environment-derived API keys to pre-approved, hardcoded or verified provider endpoints rather than arbitrary base URLs.
- Introduce an internal credential abstraction that prevents direct serialization of secrets into caller-controlled HTTP headers.
- Apply policy-based controls that block attaching sensitive tokens to destinations that are not explicitly trusted or do not match an allowlist.
- Use distinct, scoped tokens for internal service communication and external provider access, avoiding reuse across different trust boundaries.
- Reduce privilege of stored API keys by using short-lived, revocable tokens where the provider supports them.
Mitigation should focus on strict isolation and controlled use of secrets:
- Limit the use of environment-derived API keys to pre-approved, hardcoded or verified provider endpoints rather than arbitrary base URLs.
- Introduce an internal credential abstraction that prevents direct serialization of secrets into caller-controlled HTTP headers.
- Apply policy-based controls that block attaching sensitive tokens to destinations that are not explicitly trusted or do not match an allowlist.
- Use distinct, scoped tokens for internal service communication and external provider access, avoiding reuse across different trust boundaries.
- Reduce privilege of stored API keys by using short-lived, revocable tokens where the provider supports them.
How teams detect issues like this
Effective detection strategies can include:
- Static analysis rules that flag code paths where environment variables containing secrets are written directly into HTTP headers or query parameters.
- Configuration and code review checklists that require verification of all outbound destinations receiving Authorization headers derived from provider keys.
- Logging and monitoring of outbound HTTP traffic for unexpected Authorization values or destinations leaving controlled network boundaries.
- Policy enforcement in CI/CD to prevent merging changes that introduce new flows of secret-bearing headers to dynamic or user-controlled URLs.
- Optional use of automated security review tools that can trace dataflow from secret sources to network sinks and raise alerts.
Effective detection strategies can include:
- Static analysis rules that flag code paths where environment variables containing secrets are written directly into HTTP headers or query parameters.
- Configuration and code review checklists that require verification of all outbound destinations receiving Authorization headers derived from provider keys.
- Logging and monitoring of outbound HTTP traffic for unexpected Authorization values or destinations leaving controlled network boundaries.
- Policy enforcement in CI/CD to prevent merging changes that introduce new flows of secret-bearing headers to dynamic or user-controlled URLs.
- Optional use of automated security review tools that can trace dataflow from secret sources to network sinks and raise alerts.
