CVE-2026-67425: Flyto2 Core: LLM/API keys leak to an attacker-controlled base_url

llm.chat reads the operator’s provider key from the environment (OPENAI_API_KEY, ANTHROPIC_API_KEY, …) and sends it in the Authorization: Bearer header to base_url, a parameter the caller controls. base_url is only checked against the SSRF guard, and the guard allows any public host, so pointing base_url at an attacker’s server hands them the operator’s key. flyto-core’s own bounty scale rates “environment access exposing secrets (e.g. ANTHROPIC_API_KEY)” as High.