Is CVE-2026-55787 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-55787 being exploited in the wild.

How severe is CVE-2026-55787?

High severity, with a CVSS score of 7.1, published 14 October 2026.

Which products and versions are affected?

flyto-core (PyPI) <= 2.26.2, ECOSYSTEM:introduced=0,fixed=2.26.3.

Is there a fix for CVE-2026-55787?

Yes. flyto-core (PyPI): upgrade to 2.26.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-55787 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-55787?

Check whether you run flyto-core (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-55787: flytohub flyto-core SSRF bypass via IPv6 transition addresses

Q: Which products and versions are affected?

flyto-core (PyPI) <= 2.26.2, ECOSYSTEM:introduced=0,fixed=2.26.3.

Q: Is there a fix for CVE-2026-55787?

Yes. flyto-core (PyPI): upgrade to 2.26.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-55787 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-55787?

Check whether you run flyto-core (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-55787 · Severity: high · CVSS 7.1 · Published 2026-10-14

flyto-core, a library used for workflow automation, contains a security flaw in how it validates web addresses. The system attempts to block access to private internal networks, but attackers can bypass these protections by using specific IPv6 address formats that hide internal IPv4 targets. If exploited, an attacker could steal sensitive data from internal services, such as cloud credentials or private administrative interfaces, that are not intended to be accessible from the outside.

Technologies: flyto-core (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2026-55787 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-55787 being exploited in the wild.
How severe is CVE-2026-55787?: High severity, with a CVSS score of 7.1, published 14 October 2026.
Which products and versions are affected?: flyto-core (PyPI) <= 2.26.2, ECOSYSTEM:introduced=0,fixed=2.26.3.
Is there a fix for CVE-2026-55787?: Yes. flyto-core (PyPI): upgrade to 2.26.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-55787 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-55787?: Check whether you run flyto-core (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

flyto-core (PyPI): upgrade to 2.26.3 or later
```
pip install "flyto-core>=2.26.3"
```

Technical details

A Server-Side Request Forgery (SSRF) vulnerability exists in flyto-core's `validate_url_ssrf` and `is_private_ip` functions within `src/core/utils.py`. The guard fails to account for IPv6 transition mechanisms (IPv4-mapped `::ffff:a.b.c.d`, 6to4 `2002::/16`, and NAT64 `64:ff9b::/96`) that embed IPv4 addresses. An authenticated workflow author can provide a URL using these formats to bypass the private IP range check, allowing the `aiohttp` client to fetch data from internal loopback or cloud metadata services (IMDS). The vulnerability is confirmed to affect multiple modules including `http.get`, `browser.goto`, and `llm.chat`. A fix is available in version 2.26.3 which unwraps embedded IPv4 addresses before validation.

Affected products

flytohub flyto-core <= 2.26.2

Identifiers

CVE-2026-55787
GHSA-794r-5rp2-fpg8
PYSEC-2026-2481

Timeline

2026-05-30: disclosed: Initial report by tonghuaroot
2026-05-30: advisory
2026-07-06: patched: Version 2.26.3 released

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.