CVE-2026-55787 Details
Description
Flyto2 Core is an execution kernel for automation and AI-agent workflows. Prior to 2.26.3, validate_url_ssrf and is_private_ip in src/core/utils.py compare resolved addresses only against native private IPv4 and IPv6 ranges and do not unwrap IPv4-mapped, IPv4-compatible, 6to4, or NAT64 transition addresses. An authenticated workflow author can provide a transition-form literal URL through the Execution API POST /v1/execute route, http.get, or sibling guarded outbound-request modules, causing the guard to accept an address whose embedded IPv4 points to loopback, RFC 1918, or cloud metadata services. On a host that routes the selected transition form, the outbound request reaches the internal destination and returns the response body to the workflow caller, enabling read SSRF and disclosure of internal-service data or cloud credentials. This issue is fixed in version 2.26.3.
A server-side request forgery (SSRF) vulnerability has been identified in Flyto2 Core versions prior to 2.26.3. The issue arises in the URL validation functions 'validate_url_ssrf' and 'is_private_ip', which fail to properly handle certain IPv6 transition address forms that embed IPv4 addresses. This oversight allows an authenticated workflow author to bypass the application's security measures and access internal services or cloud metadata endpoints, potentially leading to unauthorized data disclosure.
Users can upgrade to Flyto2 Core version 2.26.3 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 14, 2026CISA-ADP
Assessed Oct 15, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/flytohub/flyto-core/security/advisories/GHSA-794r-5rp2-fpg8 | CISA-ADP | AdvisoryRemedyVendor |
| https://github.com/flytohub/flyto-core/commit/519e040384a74984848c4e84a6600e5f1020a6d2 | [email protected] | Source CodeVendor |
| https://github.com/flytohub/flyto-core/pull/20 | [email protected] | Issue TrackingVendor |
| https://github.com/flytohub/flyto-core/releases/tag/v2.26.3 | [email protected] | Release NotesVendor |
| https://github.com/flytohub/flyto-core/security/advisories/GHSA-794r-5rp2-fpg8 | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-918 | Server-Side Request Forgery (SSRF) | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Flyto2 Core | <= 2.26.2 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 15, 2026 | CVE Modified | CISA-ADP |
| Oct 14, 2026 | New CVE Received | [email protected] |