Product

Flyto Core

3 briefs RSS

SSRF Vulnerability in flyto-core via DNS Rebinding

A Server-Side Request Forgery (SSRF) vulnerability in flyto-core 2.26.7 allows attackers to bypass URL validation via DNS rebinding and interact with internal network resources.

flyto-core

2t 3d ago

critical threat

Unauthenticated SSRF and Secret Exfiltration in Flyto Core

1 rule 4 TTPs 1 CVE

An unauthenticated SSRF vulnerability in the Flyto Core /run endpoint allows attackers to exfiltrate the internal FLYTO_RUNNER_SECRET and perform unauthorized requests against internal infrastructure.

Flyto Core ssrf credential-theft vulnerability cve-2026-67426 path-traversal arbitrary-file-write rce framework

1r 4t 1c 3w ago

high advisory

flyto-core SSRF Bypass via IPv6 Transition Addresses (CWE-918)

3 TTPs 3 IOCs

An authenticated workflow author can bypass `flyto-core`'s Server-Side Request Forgery (SSRF) protection by crafting URLs with IPv6 transition addresses that embed private IPv4s, allowing for data exfiltration from internal services like cloud instance metadata.

flyto-core ssrf vulnerability python defense-evasion

3t 3i Jul 6, 2026