Server-Side Request Forgery Guard Bypass in Flyto2 Core by FlytoHub

CVE-2026-73530

What is CVE-2026-73530?

Flyto2 Core prior to version 2.28.0 suffers from a vulnerability that allows attackers to exploit server-side request forgery (SSRF) protections. By using specific IPv6 addresses, particularly ::, attackers can bypass internal network restrictions, enabling them to send requests to internal services that should otherwise be protected. The vulnerability arises from the misrouting of IPv6 addresses, which are mistakenly treated like loopback addresses. This flaw can lead to unauthorized access to vulnerable services, compromising the integrity and security of the system.

References