Description

Flyto2 Core before 2.28.0 contains a server-side request forgery guard bypass vulnerability that allows attackers to reach internal services by supplying URLs using the unblocked IPv6 address `::` which the kernel routes to loopback identically to `0.0.0.0`. Attackers can submit requests or trigger 302 redirects to ` to bypass the private IP range and blocked hostname checks in `is_private_ip()`, reaching services bound to IPv6 loopback across the `http.get`, `http.request`, and `http.batch` modules.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.7",
  "pubDate": "2026-08-13T20:17:29.590Z",
  "pubdate": "2026-08-13T20:17:29.590Z",
  "executiveSummary": "Flyto2 Core before version 2.28.0 is affected by a server-side request forgery (SSRF) guard bypass vulnerability. The flaw allows remote attackers to reach internal network services and loopback interfaces by supplying specially crafted URLs utilizing the unblocked IPv6 address `::`. This address is routed by the operating system kernel to the loopback interface identically to `0.0.0.0`.\nThe vulnerability directly impacts the `http.get`, `http.request`, and `http.batch` modules within the affected software. By exploiting this gap in network controls, attackers can successfully bypass private IP range restrictions and blocked hostname validations enforced by the `is_private_ip()` function. This exposure grants unauthorized access to internal microservices, administrative interfaces, and backend systems bound to IPv6 loopback addresses.\nThe risk implication is high, as successful exploitation enables attackers to interact with internal infrastructure normally protected from external network zones. Threat actors achieve this by submitting malicious input parameters or triggering HTTP 302 redirects pointing to the restricted address space, bypassing security boundary checks without requiring prior authentication.",
  "technicalDetails": "The root cause of the vulnerability lies in an incomplete implementation of IP address filtering within the `is_private_ip()` validation logic in Flyto2 Core before 2.28.0. While the function correctly identifies and blocks standard IPv4 and certain IPv6 private and loopback ranges (such as `0.0.0.0`), it fails to account for the unspecified IPv6 address `::`.\nAt the operating system kernel level, the IPv6 address `::` functions as an alias for the local loopback interface, behaving identically to `0.0.0.0` in IPv4. Because `::` is omitted from the blocklist in `is_private_ip()`, URL validation checks fail to flag it as a prohibited internal destination.\nThe attack flow proceeds as follows: an unauthenticated attacker supplies a maliciously crafted URL containing the unblocked IPv6 address `::` (or leverages an HTTP 302 redirect pointing to it) via inputs processed by the `http.get`, `http.request`, or `http.batch` modules. The application passes the `is_private_ip()` validation routine because the string `::` does not match the hardcoded private IPv4 or blocked hostname lists. Subsequently, the underlying HTTP client library executes the request against the resolved IPv6 loopback address.\nVulnerable components include the `http.get`, `http.request`, and `http.batch` modules, alongside the IP filtering logic encapsulated in `is_private_ip()`. All versions of Flyto2 Core prior to 2.28.0 are affected. The vulnerability is exploitable remotely over network exposure points that accept user-controlled URLs, requiring no authentication or elevated privileges."
}