Flyto2 Core: LLM API key leakage flaw lets attackers steal OpenAI and Anthropic keys via base_url

Security researchers disclosed a high-severity vulnerability (CVE-2026-67425) in the open-source Flyto2 Core AI-agent framework’s llm.chat function, which sends the operator’s LLM provider API keys—including OPENAI_API_KEY and ANTHROPIC_API_KEY—in an authorization header to any base_url the caller specifies. The only safeguard was a server-side request forgery check that blocked private/internal addresses but allowed any public one, so an attacker who could invoke llm.chat through the framework’s MCP or hosted HTTP API could redirect the key to a server they controlled. Related modules (ai.model, llm.agent, vector.connector) were also affected. No exploitation in the wild was reported; a fix was released in versions 2.26.6/2.26.7.