Summary
Flyto2 Core's workflow engine variable resolver expands ${env.VAR} into any host environment variable without enforcing the configured capability policy.
When a workflow can inject such variable references, it may exfiltrate secrets that should be blocked by env-related denylist rules, especially through otherwise allowed modules and sinks.
Flyto2 Core's workflow engine variable resolver expands ${env.VAR} into any host environment variable without enforcing the configured capability policy.
When a workflow can inject such variable references, it may exfiltrate secrets that should be blocked by env-related denylist rules, especially through otherwise allowed modules and sinks.
Affected context
This vulnerability arises in Flyto2 Core deployments where:
- Workflows or agents can define or influence parameters that are later resolved by the engine's variable resolver
- The system relies on a capability policy (denylist/allowlist) to control access to environment variables via functions like
env.getorenv.load_dotenv - Environment variables include sensitive secrets such as API keys, tokens, database credentials, or cloud access keys
In these conditions, the implicit ${env.VAR} expansion path becomes a backdoor that bypasses the intended capability enforcement.
This vulnerability arises in Flyto2 Core deployments where:
- Workflows or agents can define or influence parameters that are later resolved by the engine's variable resolver
- The system relies on a capability policy (denylist/allowlist) to control access to environment variables via functions like
env.getorenv.load_dotenv - Environment variables include sensitive secrets such as API keys, tokens, database credentials, or cloud access keys
In these conditions, the implicit ${env.VAR} expansion path becomes a backdoor that bypasses the intended capability enforcement.
Exploit preconditions
- Attack surface: Workflow parameter injection or modification, including:
- User-provided workflow inputs
- Agent-generated prompts or configurations
- Integration code that passes parameters into the workflow engine
- Required access: Ability to define or alter parameters that the Flyto2 Core resolver processes (e.g., template strings containing
${env.VAR}). - Trigger point: Execution of a workflow step where the engine resolves variables and then passes the resolved values into allowed modules (HTTP clients, loggers, storage connectors, etc.).
- Why exploitation is possible: The resolver expands
${env.VAR}using unguarded access to all host environment variables, and this expansion is not checked against the capability policy denylist forenv.getorenv.load_dotenv. As a result, policy-governed secret access controls are silently bypassed via the resolver path.
- Attack surface: Workflow parameter injection or modification, including:
- User-provided workflow inputs
- Agent-generated prompts or configurations
- Integration code that passes parameters into the workflow engine
- Required access: Ability to define or alter parameters that the Flyto2 Core resolver processes (e.g., template strings containing
${env.VAR}). - Trigger point: Execution of a workflow step where the engine resolves variables and then passes the resolved values into allowed modules (HTTP clients, loggers, storage connectors, etc.).
- Why exploitation is possible: The resolver expands
${env.VAR}using unguarded access to all host environment variables, and this expansion is not checked against the capability policy denylist forenv.getorenv.load_dotenv. As a result, policy-governed secret access controls are silently bypassed via the resolver path.
Why this happens
The root cause is an inconsistent enforcement of environment access controls inside the workflow engine's variable resolution layer.
While explicit environment access functions (e.g., env.get) are subject to a capability policy and denylist, the ${env.VAR} expansion mechanism directly reads host environment variables without consulting the same policy.
This constitutes a policy bypass under CWE-693: Protection Mechanism Failure, and is closely related to improper handling of credentials (CWE-522) and incorrect resource exposure via an unintended interface (CWE-668). The abstract insecure pattern is a secondary access path to protected data that omits security checks assumed to be global.
The root cause is an inconsistent enforcement of environment access controls inside the workflow engine's variable resolution layer.
While explicit environment access functions (e.g., env.get) are subject to a capability policy and denylist, the ${env.VAR} expansion mechanism directly reads host environment variables without consulting the same policy.
This constitutes a policy bypass under CWE-693: Protection Mechanism Failure, and is closely related to improper handling of credentials (CWE-522) and incorrect resource exposure via an unintended interface (CWE-668). The abstract insecure pattern is a secondary access path to protected data that omits security checks assumed to be global.
Potential impact
- Workflow parameters may expose API keys, tokens, and other confidential environment-based secrets.
- Attackers could exfiltrate secrets to external services via permitted modules (e.g., HTTP, messaging, logging).
- Compromise of downstream systems that trust environment-based credentials (databases, cloud services, CI/CD pipelines).
- Escalation from low-privilege workflow access to broader infrastructure access by harvesting privileged environment variables.
- Undermining of organizational capability policies, leading to loss of trust in policy-based controls across automation and AI-agent workflows.
- Workflow parameters may expose API keys, tokens, and other confidential environment-based secrets.
- Attackers could exfiltrate secrets to external services via permitted modules (e.g., HTTP, messaging, logging).
- Compromise of downstream systems that trust environment-based credentials (databases, cloud services, CI/CD pipelines).
- Escalation from low-privilege workflow access to broader infrastructure access by harvesting privileged environment variables.
- Undermining of organizational capability policies, leading to loss of trust in policy-based controls across automation and AI-agent workflows.
General mitigation guidance
Effective mitigation focuses on aligning all environment-variable access paths with a single, enforceable policy and reducing secret exposure by design.
Recommended pattern-level strategies include:
- Centralize environment access behind a controlled abstraction that always consults capability and policy rules, including template or resolver expansions.
- Introduce explicit allowlists for which environment variables may be referenced from workflows, and treat all others as non-resolvable within engine templates.
- Implement secret segmentation so high-value credentials are not broadly present in the host environment; use scoped secret stores or per-workflow credentials instead.
- Apply least-privilege principles to automation and agent workflows, ensuring they only receive the minimal configuration data necessary for their tasks.
- Default to non-resolution or safe placeholders for
${env.VAR}-style references unless they pass validation against a security-aware configuration schema. - Adopt secure configuration patterns where secret material is accessed through dedicated secret-management integrations rather than generic environment expansion.
Effective mitigation focuses on aligning all environment-variable access paths with a single, enforceable policy and reducing secret exposure by design.
Recommended pattern-level strategies include:
- Centralize environment access behind a controlled abstraction that always consults capability and policy rules, including template or resolver expansions.
- Introduce explicit allowlists for which environment variables may be referenced from workflows, and treat all others as non-resolvable within engine templates.
- Implement secret segmentation so high-value credentials are not broadly present in the host environment; use scoped secret stores or per-workflow credentials instead.
- Apply least-privilege principles to automation and agent workflows, ensuring they only receive the minimal configuration data necessary for their tasks.
- Default to non-resolution or safe placeholders for
${env.VAR}-style references unless they pass validation against a security-aware configuration schema. - Adopt secure configuration patterns where secret material is accessed through dedicated secret-management integrations rather than generic environment expansion.
How teams detect issues like this
Detection generally relies on both code-level and configuration-level analysis of the workflow engine and its usage patterns.
Useful approaches include:
- Static analysis checks for variable resolvers and template engines that directly access environment variables without policy hooks or guardrails.
- Configuration reviews to identify workflow templates or parameters containing
${env.*}patterns, especially in contexts that forward resolved values to external sinks. - Policy enforcement tests that verify environment-based access is consistently blocked or allowed across all access paths, including implicit resolvers and helper utilities.
- Runtime logging and monitoring of workflow variable resolution, flagging occurrences where environment values are read and passed to network, storage, or logging modules.
- Integration of automated security review tools into CI/CD to scan for unmediated environment reads and policy inconsistencies in automation and agent frameworks.
Detection generally relies on both code-level and configuration-level analysis of the workflow engine and its usage patterns.
Useful approaches include:
- Static analysis checks for variable resolvers and template engines that directly access environment variables without policy hooks or guardrails.
- Configuration reviews to identify workflow templates or parameters containing
${env.*}patterns, especially in contexts that forward resolved values to external sinks. - Policy enforcement tests that verify environment-based access is consistently blocked or allowed across all access paths, including implicit resolvers and helper utilities.
- Runtime logging and monitoring of workflow variable resolution, flagging occurrences where environment values are read and passed to network, storage, or logging modules.
- Integration of automated security review tools into CI/CD to scan for unmediated environment reads and policy inconsistencies in automation and agent frameworks.
