Executive brief
flyto-core, a library used for workflow automation, contains a security flaw in how it validates web addresses. The system attempts to block access to private internal networks, but attackers can bypass these protections by using specific IPv6 address formats that hide internal IPv4 targets. If exploited, an attacker could steal sensitive data from internal services, such as cloud credentials or private administrative interfaces, that are not intended to be accessible from the outside.
Technical details
A Server-Side Request Forgery (SSRF) vulnerability exists in flyto-core's `validate_url_ssrf` and `is_private_ip` functions within `src/core/utils.py`. The guard fails to account for IPv6 transition mechanisms (IPv4-mapped `::ffff:a.b.c.d`, 6to4 `2002::/16`, and NAT64 `64:ff9b::/96`) that embed IPv4 addresses. An authenticated workflow author can provide a URL using these formats to bypass the private IP range check, allowing the `aiohttp` client to fetch data from internal loopback or cloud metadata services (IMDS). The vulnerability is confirmed to affect multiple modules including `http.get`, `browser.goto`, and `llm.chat`. A fix is available in version 2.26.3 which unwraps embedded IPv4 addresses before validation.
Affected products
- flytohub flyto-core <= 2.26.2
Timeline
- 2026-05-30: disclosed: Initial report by tonghuaroot
- 2026-05-30: advisory
- 2026-07-06: patched: Version 2.26.3 released