Answer in brief
CVE-2026-73530 records a Unknown severity vulnerability in Flyto2 Core < 2.28.0 SSRF Guard Bypass via is_private_ip(). The current sources do not mark it as known exploited. The current feed maps flytohub/flyto-core (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps flytohub/flyto-core (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| flytohub/flyto-coregeneric | >=0 <2.28.0 | 2.28.0 |
Published upstream
Aug 13, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Aug 13, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 13, 2026
Flyto2 Core before 2.28.0 contains a server-side request forgery guard bypass vulnerability that allows attackers to reach internal services by supplying URLs using the unblocked IPv6 address `::` which the kernel routes to loopback identically to `0.0.0.0`. Attackers can submit requests or trigger 302 redirects to ` to bypass the private IP range and blocked hostname checks in `is_private_ip()`, reaching services bound to IPv6 loopback across the `http.get`, `http.request`, and `http.batch` modules.
Quoted source text, attributed separately from HOL analysis.
Answer in brief
CVE-2026-73530 records a Unknown severity vulnerability in Flyto2 Core < 2.28.0 SSRF Guard Bypass via is_private_ip(). The current sources do not mark it as known exploited. The current feed maps flytohub/flyto-core (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps flytohub/flyto-core (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| flytohub/flyto-coregeneric | >=0 <2.28.0 | 2.28.0 |
Published upstream
Aug 13, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Aug 13, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 13, 2026
Flyto2 Core before 2.28.0 contains a server-side request forgery guard bypass vulnerability that allows attackers to reach internal services by supplying URLs using the unblocked IPv6 address `::` which the kernel routes to loopback identically to `0.0.0.0`. Attackers can submit requests or trigger 302 redirects to ` to bypass the private IP range and blocked hostname checks in `is_private_ip()`, reaching services bound to IPv6 loopback across the `http.get`, `http.request`, and `http.batch` modules.
Quoted source text, attributed separately from HOL analysis.