Summary
Flyto2 Core's HTTP-emitting workflow modules can be directed to fetch attacker-controlled URLs without proper environment-based validation, creating a server-side request forgery (SSRF) condition.
When workflows or agents accept unvalidated URLs, an attacker may pivot these outbound requests toward internal services or cloud metadata endpoints, exposing sensitive data or internal functionality.
Flyto2 Core's HTTP-emitting workflow modules can be directed to fetch attacker-controlled URLs without proper environment-based validation, creating a server-side request forgery (SSRF) condition.
When workflows or agents accept unvalidated URLs, an attacker may pivot these outbound requests toward internal services or cloud metadata endpoints, exposing sensitive data or internal functionality.
Affected context
This vulnerability appears in Flyto2 Core automation and AI-agent workflows that use HTTP-emitting modules such as core.api.http_get, core.api.http_post, GraphQL query/mutation helpers, monitoring HTTP checks, and notification integrations.
It is most relevant where:
- Workflows accept or construct URLs based on user, tenant, or agent-provided input
- The affected modules are allowed to reach network locations beyond a tightly scoped allowlist
- Flyto2 Core instances have connectivity to internal services, management APIs, or cloud metadata URLs
The risk increases in deployments where the execution kernel runs with broad network access or alongside sensitive internal components.
This vulnerability appears in Flyto2 Core automation and AI-agent workflows that use HTTP-emitting modules such as core.api.http_get, core.api.http_post, GraphQL query/mutation helpers, monitoring HTTP checks, and notification integrations.
It is most relevant where:
- Workflows accept or construct URLs based on user, tenant, or agent-provided input
- The affected modules are allowed to reach network locations beyond a tightly scoped allowlist
- Flyto2 Core instances have connectivity to internal services, management APIs, or cloud metadata URLs
The risk increases in deployments where the execution kernel runs with broad network access or alongside sensitive internal components.
Exploit preconditions
- Attack surface: Workflow interfaces, agent inputs, API endpoints, or configuration surfaces that allow specifying or influencing target URLs used by Flyto2 Core HTTP modules.
- Required access: Ability to submit or manipulate URL parameters in automation tasks, AI-agent prompts, monitoring configurations, or notification settings (e.g., authenticated user, misconfigured agent, or compromised tenant).
- Trigger point: Execution of an HTTP-emitting module (e.g.,
http_get,graphql.query,monitor.http_check, notification senders) that uses the provided URL without callingvalidate_url_with_env_config. - Why exploitation is possible: The modules rely on caller-supplied URLs and do not enforce environment-aware validation or strict allowlists, allowing requests to arbitrary destinations, including internal network addresses and cloud instance metadata endpoints.
- Attack surface: Workflow interfaces, agent inputs, API endpoints, or configuration surfaces that allow specifying or influencing target URLs used by Flyto2 Core HTTP modules.
- Required access: Ability to submit or manipulate URL parameters in automation tasks, AI-agent prompts, monitoring configurations, or notification settings (e.g., authenticated user, misconfigured agent, or compromised tenant).
- Trigger point: Execution of an HTTP-emitting module (e.g.,
http_get,graphql.query,monitor.http_check, notification senders) that uses the provided URL without callingvalidate_url_with_env_config. - Why exploitation is possible: The modules rely on caller-supplied URLs and do not enforce environment-aware validation or strict allowlists, allowing requests to arbitrary destinations, including internal network addresses and cloud instance metadata endpoints.
Why this happens
The underlying flaw is the lack of robust server-side validation on outbound HTTP target URLs before they are used by Flyto2 Core's workflow and agent modules.
Instead of restricting requests to a controlled set of domains or validating against environment configuration, the affected functions treat caller-controlled URLs as trusted destinations.
This behavior maps to CWE-918: Server-Side Request Forgery (SSRF): a server-side component issues network requests based on untrusted input, enabling attackers to abuse the server's network position to access internal services or sensitive metadata that are not directly reachable from the outside.
The underlying flaw is the lack of robust server-side validation on outbound HTTP target URLs before they are used by Flyto2 Core's workflow and agent modules.
Instead of restricting requests to a controlled set of domains or validating against environment configuration, the affected functions treat caller-controlled URLs as trusted destinations.
This behavior maps to CWE-918: Server-Side Request Forgery (SSRF): a server-side component issues network requests based on untrusted input, enabling attackers to abuse the server's network position to access internal services or sensitive metadata that are not directly reachable from the outside.
Potential impact
- Access to internal HTTP services that are otherwise firewalled from external networks
- Retrieval of cloud provider instance metadata, including tokens or credentials that can be further abused
- Enumeration of internal application endpoints and infrastructure components
- Interaction with administrative or management APIs exposed only on private networks
- Use of the platform as a proxy for additional attacks, such as credential harvesting, lateral reconnaissance, or privilege escalation
- Access to internal HTTP services that are otherwise firewalled from external networks
- Retrieval of cloud provider instance metadata, including tokens or credentials that can be further abused
- Enumeration of internal application endpoints and infrastructure components
- Interaction with administrative or management APIs exposed only on private networks
- Use of the platform as a proxy for additional attacks, such as credential harvesting, lateral reconnaissance, or privilege escalation
General mitigation guidance
Effective mitigation focuses on constraining where server-side HTTP modules can send requests and reducing trust in caller-supplied URLs.
Common defensive patterns include:
- Applying strict allowlist-based URL validation tied to environment configuration, so modules can only reach approved domains or service categories.
- Normalizing and parsing URLs server-side, rejecting those that target private IP ranges, loopback interfaces, link-local addresses, or known metadata endpoints.
- Segmenting network access for workflow execution environments, ensuring they cannot directly reach sensitive internal management planes or metadata services.
- Designing workflow and agent APIs to accept high-level resource identifiers instead of raw URLs, mapping them to safe destinations internally.
- Enforcing least-privilege for outbound connectivity, combined with firewall rules and service mesh policies that restrict reachable targets from the execution kernel.
Effective mitigation focuses on constraining where server-side HTTP modules can send requests and reducing trust in caller-supplied URLs.
Common defensive patterns include:
- Applying strict allowlist-based URL validation tied to environment configuration, so modules can only reach approved domains or service categories.
- Normalizing and parsing URLs server-side, rejecting those that target private IP ranges, loopback interfaces, link-local addresses, or known metadata endpoints.
- Segmenting network access for workflow execution environments, ensuring they cannot directly reach sensitive internal management planes or metadata services.
- Designing workflow and agent APIs to accept high-level resource identifiers instead of raw URLs, mapping them to safe destinations internally.
- Enforcing least-privilege for outbound connectivity, combined with firewall rules and service mesh policies that restrict reachable targets from the execution kernel.
How teams detect issues like this
Organizations can detect and manage SSRF risks in HTTP workflow engines through multiple layers:
- Static analysis rules that flag modules or functions that perform outbound HTTP requests using unvalidated, user-influenced URLs.
- Code review practices that focus on any helper like
http_get,http_post, GraphQL clients, or notification senders, verifying presence of centralized URL validation and environment-aware allowlists. - Configuration audits that confirm workflow definitions and agent templates do not expose raw URL parameters without validation steps or policy checks.
- Network monitoring and logging to identify unusual outbound requests from workflow runtimes, such as traffic to internal IP ranges, metadata endpoints, or previously unseen domains.
- Policy enforcement within CI/CD or governance pipelines to require use of common validation utilities (e.g., a function analogous to
validate_url_with_env_config) whenever new HTTP-emitting modules are introduced.
Organizations can detect and manage SSRF risks in HTTP workflow engines through multiple layers:
- Static analysis rules that flag modules or functions that perform outbound HTTP requests using unvalidated, user-influenced URLs.
- Code review practices that focus on any helper like
http_get,http_post, GraphQL clients, or notification senders, verifying presence of centralized URL validation and environment-aware allowlists. - Configuration audits that confirm workflow definitions and agent templates do not expose raw URL parameters without validation steps or policy checks.
- Network monitoring and logging to identify unusual outbound requests from workflow runtimes, such as traffic to internal IP ranges, metadata endpoints, or previously unseen domains.
- Policy enforcement within CI/CD or governance pipelines to require use of common validation utilities (e.g., a function analogous to
validate_url_with_env_config) whenever new HTTP-emitting modules are introduced.
