Flyto2 Core SSRF via Unvalidated URLs in HTTP-Emitting Agent Modules

Technical Analysis

The vulnerability stems from missing calls to validate_url_with_env_config across a broad set of tool modules that accept URLs as parameters, including generic HTTP verbs, GraphQL operations, chat/notification integrations (Slack, Discord, Teams), monitoring checks, AI vision analysis, visual diffing, browser proxy rotation, and the agent/llm inline base_url configuration path. Because LLM agents frequently construct or forward URLs based on model output, prompt content, or upstream tool responses, an attacker who can influence prompts, tool arguments, or configuration (via prompt injection or a poisoned upstream data source) can redirect these HTTP-emitting calls to internal-only endpoints such as cloud metadata services (e.g., 169.254.169.254), internal admin panels, or other network-restricted resources. This crosses the boundary between the LLM's semantic/text layer and the framework's network-execution layer: text-level manipulation becomes a network-level SSRF primitive. Successful exploitation can yield credential theft (cloud IAM tokens), internal service enumeration, and further lateral movement, especially dangerous given the breadth of affected modules spanning core HTTP, integrations, and the LLM base_url configuration itself.

Affected Systems

Flyto2 Core

Detection Signatures

• Outbound HTTP/HTTPS requests from Flyto2 Core processes to RFC1918 ranges, link-local addresses, or 169.254.169.254 metadata endpoints
• Requests to internal hostnames or non-allowlisted domains originating from modules: core.api.http_get, core.api.http_post, graphql.query, graphql.mutation, monitor.http_check, communication.slack_send, notification.discord.send_message, notification.slack.send_message, notification.teams.send_message, ai.vision_analyze, verify.visual_diff, browser.proxy_rotate
• Agent or LLM configuration containing attacker-influenced base_url values pointing to non-standard or internal endpoints
• Absence of validate_url_with_env_config invocation in HTTP-emitting module call stacks (static/code review)
• Anomalous spikes in requests to cloud metadata service IP ranges correlated with agent workflow execution logs

Remediation Steps

1. 1

   Upgrade Flyto2 Core

   Upgrade to version 2.26.7 or later, which enforces validate_url_with_env_config across all listed HTTP-emitting modules.

2. 2

   Enforce network egress controls

   Deploy network-level egress filtering/firewall rules to block agent/automation hosts from reaching cloud metadata endpoints (169.254.169.254) and internal-only IP ranges.

3. 3

   Apply URL allowlisting at the application layer

   Independently of the vendor patch, implement strict allowlists for any URL-accepting tool or module used by AI agents, rejecting private/internal/loopback/link-local address ranges.

4. 4

   Audit and sanitize agent-controlled inputs

   Review workflows where LLM or agent output feeds directly into URL parameters for HTTP, GraphQL, or notification modules, and add input validation/sanitization boundaries between model output and network-calling code.

5. 5

   Rotate and scope cloud credentials

   Use short-lived, scoped IAM credentials with IMDSv2 (or equivalent) enforcement on hosts running Flyto2 Core to limit blast radius if metadata SSRF is attempted.