CVE-2026-73530
Flyto2 Core < 2.28.0 SSRF Guard Bypass via is_private_ip()
CVSS Score
7.7
EPSS Score
0.0%
EPSS Percentile
0th
Flyto2 Core before 2.28.0 contains a server-side request forgery guard bypass vulnerability that allows attackers to reach internal services by supplying URLs using the unblocked IPv6 address `::` which the kernel routes to loopback identically to `0.0.0.0`. Attackers can submit requests or trigger 302 redirects to ` to bypass the private IP range and blocked hostname checks in `is_private_ip()`, reaching services bound to IPv6 loopback across the `http.get`, `http.request`, and `http.batch` modules.
| CWE | CWE-918 |
| Vendor | flytohub |
| Product | flyto-core |
| Published | Aug 13, 2026 |
| Last Updated | Aug 13, 2026 |
Stay Ahead of the Next One
Get instant alerts for flytohub flyto-core
Be the first to know when new high vulnerabilities affecting flytohub flyto-core are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Changed
Confidentiality
High
Integrity
None
Availability
None
Affected Versions
flytohub / flyto-core
0 < 2.28.0
References
Credits
euriconicacio