CVE-2026-67424 affects Flyto2 Core, an execution kernel for automation and AI-agent workflows. Versions prior to 2.26.7 contain an SSRF (Server-Side Request Forgery) vulnerability in the HTTP modules http.get, http.request, and http.batch. The flaw exists because only the initial URL is validated, while subsequent redirects are followed without per-hop Location header revalidation. This allows an attacker to craft a public URL that redirects into internal address space, potentially exposing internal services and their response bodies. The affected files are get.py, request.py, and batch.py within the atomic HTTP module path. The vulnerability has been patched in version 2.26.7. Fixes are available via the official GitHub release and commit. This issue is particularly concerning in AI-agent and automation workflow contexts where HTTP modules may be invoked with attacker-influenced URLs.