CVE-2026-73530

Received Received - Intake

Server-Side Request Forgery Bypass in Flyto2 Core

Publication date: 2026-08-13

Last updated on: 2026-08-13

Assigner: VulnCheck

Description

Flyto2 Core before 2.28.0 contains a server-side request forgery guard bypass vulnerability that allows attackers to reach internal services by supplying URLs using the unblocked IPv6 address `::` which the kernel routes to loopback identically to `0.0.0.0`. Attackers can submit requests or trigger 302 redirects to ` to bypass the private IP range and blocked hostname checks in `is_private_ip()`, reaching services bound to IPv6 loopback across the `http.get`, `http.request`, and `http.batch` modules.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-13

Last Modified

2026-08-13

Generated

2026-08-14

AI Q&A

2026-08-14

EPSS Evaluated

N/A

NVD

CVE-2026-73530

EUVD

EUVD-2026-58242

Affected Vendors & Products

Vendor	Product	Version / Range
flyto2	core	to 2.28.0 (exc)
flytohub	flyto-core	to 2.28.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-918	The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

Executive Summary

This is a Server-Side Request Forgery (SSRF) guard bypass in Flyto2 Core before version 2.28.0. The vulnerability allows attackers to bypass IP range and hostname checks by using the IPv6 unspecified address '::', which the kernel routes to loopback like '0.0.0.0'. This lets them reach internal services bound to IPv6 loopback via modules like http.get, http.request, and http.batch.

Detection Guidance

Check if your Flyto2 Core version is below 2.28.0 by running: python -c "import flyto_core; print(flyto_core.__version__)". If the output is less than 2.28.0, the system is vulnerable.

Impact Analysis

An attacker could exploit this to access internal services running on the same host via IPv6 loopback. This may allow them to retrieve sensitive data from those services, though the attack is limited to the local host and does not enable arbitrary internal host access or credential theft.

Mitigation Strategies

Upgrade Flyto2 Core to version 2.28.0 or later using: python -m pip install --upgrade flyto-core==2.28.0. This patch blocks IPv6 unspecified addresses like :: in SSRF checks.

Hi! I’m here to help you understand CVE-2026-73530. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70