CVE-2026-73530 in flyto-core
Summary
by MITRE • 08/13/2026
Flyto2 Core before 2.28.0 contains a server-side request forgery guard bypass vulnerability that allows attackers to reach internal services by supplying URLs using the unblocked IPv6 address `::` which the kernel routes to loopback identically to `0.0.0.0`. Attackers can submit requests or trigger 302 redirects to ` to bypass the private IP range and blocked hostname checks in `is_private_ip()`, reaching services bound to IPv6 loopback across the `http.get`, `http.request`, and `http.batch` modules.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 08/13/2026
This vulnerability exists within Flyto2 Core versions prior to 2.28.0 and represents a critical server-side request forgery weakness that undermines network security controls. The flaw stems from an insufficient validation mechanism that fails to properly block IPv6 loopback addresses, specifically the unblocked address `::` which functions identically to `0.0.0.0` in kernel routing. This oversight creates a bypass opportunity for attackers who can manipulate requests through the http.get, http.request, and http.batch modules to access internal services that should remain protected from external reach.
The technical implementation of this vulnerability exploits the fundamental networking behavior where IPv6 loopback addresses are routed through the same mechanism as IPv4 loopback addresses, allowing malicious actors to circumvent existing security checks designed to block private IP ranges. The `is_private_ip()` function, which is intended to prevent access to internal services, fails to account for the IPv6 loopback address format, creating a gap in the security architecture that attackers can exploit through carefully crafted requests or 302 redirects. This bypass mechanism specifically targets the network validation logic that should prevent access to localhost and private IP ranges but instead allows traffic to be routed through the IPv6 loopback interface.
The operational impact of this vulnerability is significant as it enables attackers to potentially access internal services that are typically protected behind firewalls or network segmentation controls. By leveraging the IPv6 loopback address `::`, threat actors can bypass hostname and IP range restrictions that are normally enforced, gaining access to services bound to localhost interfaces that may contain sensitive data, administrative functions, or internal APIs. This vulnerability particularly affects systems where internal services are configured to listen on IPv6 loopback addresses rather than explicit IPv4 addresses, creating an attack surface that extends beyond traditional IPv4-based security assumptions.
Organizations using Flyto2 Core versions before 2.28.0 should immediately implement mitigations including upgrading to version 2.28.0 or later where the vulnerability has been addressed through enhanced IP validation logic. Additional protective measures include implementing stricter network segmentation controls, configuring firewalls to block direct access to loopback interfaces, and monitoring for suspicious requests that attempt to use IPv6 loopback addresses in HTTP operations. The vulnerability aligns with CWE-918 Server-Side Request Forgery and follows ATT&CK tactics including T1190 Exploit Public-Facing Application and T1071.004 Application Layer Protocol: DNS, where attackers can leverage protocol weaknesses to gain unauthorized access. Security teams should also consider implementing automated scanning tools that can detect requests attempting to use loopback addresses in HTTP operations as part of their threat detection capabilities.