CVE-2026-73530
HighCVSS 7.7Exploitation Probability (EPSS)
Low risk24th percentile - higher than 24% of all known CVEs
Summary
Flyto2 Core before version 2.28.0 contains a server-side request forgery guard bypass vulnerability that allows attackers to reach internal services by supplying URLs using the unblocked IPv6 address `::` which the kernel routes to loopback identically to `0.0.0.0`. Attackers can submit requests or trigger 302 redirects to bypass the private IP range and blocked hostname checks in is_private_ip(), reaching services bound to IPv6 loopback across the http.get, http.request, and http.batch modules.
Risk Assessment
An attacker could access internal services, potentially leading to data exposure or further attacks on the infrastructure.
Recommendation
Upgrade Flyto2 Core to version 2.28.0 or later, which includes the fix.
Original NVD description (English source)
Flyto2 Core before 2.28.0 contains a server-side request forgery guard bypass vulnerability that allows attackers to reach internal services by supplying URLs using the unblocked IPv6 address `::` which the kernel routes to loopback identically to `0.0.0.0`. Attackers can submit requests or trigger 302 redirects to ` to bypass the private IP range and blocked hostname checks in `is_private_ip()`, reaching services bound to IPv6 loopback across the `http.get`, `http.request`, and `http.batch` modules.