CVE-2026-55787 flytohub CVE debrief

Who should care

Workflow authors, administrators, and security teams responsible for configuring and monitoring Flyto2 Core workflows and outbound request modules. These stakeholders should assess exposure and prioritize verification of workflow configurations and outbound request modules to prevent potential read SSRF and disclosure of internal-service data or cloud credentials.

Why it matters

CVE-2026-55787 allows an authenticated workflow author to bypass the SSRF guard in Flyto2 Core, potentially leading to read SSRF and disclosure of internal-service data or cloud credentials. Workflow authors and administrators should assess exposure and prioritize verification of workflow configurations and outbound request modules.

• Read SSRF and disclosure of internal-service data or cloud credentials
• Potential exposure of cloud metadata services
• Verification of workflow configurations and outbound request modules required

Technical summary

Flyto2 Core's validate_url_ssrf and is_private_ip functions do not unwrap IPv4-mapped, IPv4-compatible, 6to4, or NAT64 transition addresses, allowing an authenticated workflow author to bypass the SSRF guard. This can lead to read SSRF and disclosure of internal-service data or cloud credentials. The vulnerability is fixed in version 2.26.3. Affected product deployments should be verified, and compensating controls should be reviewed for exposed systems while remediation is scheduled and verified. The vulnerability allows for potential exposure of cloud metadata services.

Defensive priority

Workflow authors and administrators should assess exposure and prioritize verification of workflow configurations and outbound request modules.

Recommended defensive actions

• Verify workflow configurations for validate_url_ssrf and is_private_ip
• Update Flyto2 Core to version 2.26.3 or later
• Monitor outbound requests for suspicious activity
• Review and restrict access to Execution API POST /v1/execute route and http.get
• Perform a thorough review of workflow configurations and outbound request modules
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and source item provide details on the vulnerability, including affected versions and fixed versions. The vulnerability is caused by the validate_url_ssrf and is_private_ip functions not unwrapping IPv4-mapped, IPv4-compatible, 6to4, or NAT64 transition addresses. This allows an authenticated workflow author to bypass the SSRF guard. Evidence is limited to the provided CVE record and source item.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.