CVE-2026-73530

Name of the Vulnerable Software and Affected Versions Flyto2 Core versions prior to 2.28.0

Description A server-side request forgery guard bypass allows attackers to access internal services by using the unblocked IPv6 address ::, which the kernel routes to the loopback address similarly to 0.0.0.0. By submitting requests or triggering 302 redirects, attackers can bypass private IP range and blocked hostname checks within the is private ip() function. This affects the http.get, http.request, and http.batch modules, enabling access to services bound to the IPv6 loopback.

Recommendations Update to version 2.28.0 or later.