SSRF guard bypass in Flyto2 Core via IPv6 transition addresses
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- High
- Impact type
- —
- Confidentiality · integrity · availability
- High · Low · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub.
Summary
The flyto-core package before 2.26.3 has an SSRF guard flaw in validate_url_ssrf and is_private_ip, which check resolved addresses only against native private ranges and do not unwrap IPv4-mapped, 6to4 or NAT64 transition addresses (CWE-918). An authenticated workflow author can supply a transition-form literal URL through http.get or similar outbound modules, so the guard accepts an address that embeds a loopback, private or cloud metadata IPv4 address. On hosts that route that transition form, the request reaches the internal destination and the response body returns to the workflow caller, enabling read SSRF. CISA's SSVC assessment lists exploitation as proof of concept.
Written with Claude Haiku 5.5 from the sources below · 2026-10-28
Description from the CNA
Flyto2 Core is an execution kernel for automation and AI-agent workflows. Prior to 2.26.3, validate_url_ssrf and is_private_ip in src/core/utils.py compare resolved addresses only against native private IPv4 and IPv6 ranges and do not unwrap IPv4-mapped, IPv4-compatible, 6to4, or NAT64 transition addresses. An authenticated workflow author can provide a transition-form literal URL through the Execution API POST /v1/execute route, http.get, or sibling guarded outbound-request modules, causing the guard to accept an address whose embedded IPv4 points to loopback, RFC 1918, or cloud metadata services. On a host that routes the selected transition form, the outbound request reaches the internal destination and returns the response body to the workflow caller, enabling read SSRF and disclosure of internal-service data or cloud credentials. This issue is fixed in version 2.26.3.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| flytohub | flyto-core | before 2.26.3 | 2.26.3 | Patch available | CNA |
| — | flyto-core (PyPI) | before 2.26.3 | 2.26.3 | Patch available | GHSA-794r-5rp2-fpg8 |
- flyto-core Vendorflytohub Affected before 2.26.3 Fixed in 2.26.3 Patch available CNA
- flyto-core (PyPI) Vendor— Affected before 2.26.3 Fixed in 2.26.3 Patch available GHSA-794r-5rp2-fpg8
Remediation
Upgrade the PyPI package flyto-core to 2.26.3, which fixes this issue. The sources list no fixed version for flyto-core from flytohub.
Written with Claude Haiku 5.5 from the sources below · 2026-10-28
- Fix · CNA flyto-core (flytohub) Fixed in 2.26.3
- Fix · GHSA-794r-5rp2-fpg8 flyto-core (PyPI) Fixed in 2.26.3 Advisory →
Timeline
- 2026-10-15 Threatist record created from CVE-2026-55787
- 2026-10-16 CISA SSVC decision points changed
References
Other 5
- https://github.com/flytohub/flyto-core/security/advisories/GHSA-794r-5rp2-fpg8
- https://github.com/flytohub/flyto-core/pull/20
- https://github.com/flytohub/flyto-core/commit/519e040384a74984848c4e84a6600e5f1020a6d2
- https://github.com/flytohub/flyto-core/releases/tag/v2.26.3
- https://github.com/flytohub/flyto-core
More flytohub vulnerabilities
- TI-2026-47709 Flyto2 Core: Arbitrary file write via image.download (and other file-writing modules) CVSS 3.1CRITICAL 10.0
- TI-2026-47706 Flyto2 Core: Unauthenticated flyto-verification /run: callback_url SSRF and internal runner-secret exfiltration CVSS 3.1CRITICAL 9.3
- TI-2026-47707 Flyto2 Core: ${env.VAR} interpolation reads any env secret despite env.get being denylisted CVSS 3.1HIGH 8.6
- TI-2026-47705 Flyto2 Core: LLM/API keys leak to an attacker-controlled base_url CVSS 3.1HIGH 8.6
- TI-2026-74172 Unauthenticated command execution in Flyto2 Core over HTTP MCP CVSS 3.1HIGH 8.4
- TI-2026-47708 Server-side request forgery in flytohub flyto-core CVSS 3.1HIGH 8.5
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences