A critical vulnerability in flyto-core allows unauthenticated attackers to exfiltrate sensitive data and credentials, posing a significant risk to system confidentiality.

This vulnerability involves the improper handling of sensitive information and credentials, allowing an unauthenticated remote attacker to access data that should be protected. It stems from failures in data sanitization and credential storage mechanisms.

The exposure of sensitive information and credentials can lead to complete unauthorized access to backend systems, intellectual property theft, and the compromise of connected AI-agent workflows. With a CVSS score of 8.6, this vulnerability represents a high risk that could lead to significant data breaches and regulatory non-compliance.

Immediate Action: Update flyto-core to version 2.26.6 or later immediately to resolve the identified security flaws.

Proactive Monitoring: Review system and application logs for unusual outbound traffic patterns or unauthorized access attempts targeting credential storage modules.

Compensating Controls: Implement strict egress filtering on the network to prevent the exfiltration of data to unauthorized external endpoints.

Public Exploit Available: Unknown

Given the potential for credential exposure and the existence of a proof-of-concept, this issue must be addressed with high priority. Organizations should verify their current deployment versions and apply the 2.26.6 patch across all production environments immediately to prevent potential exploitation.