The vulnerability is a Server‑Side Request Forgery (SSRF) flaw in the URL validation logic of Flyto2 Core. The validate_url_ssrf function mistakenly accepts URLs that use IPv4‑mapped, IPv4‑compatible, 6to4, or NAT64 transition addresses, enabling an authenticated workflow author to craft a request that resolves to a private or loopback address embedded inside the IPv6 address. When such a URL is submitted through the Execution API or an outbound-request module, the host performs the request to the internal destination and returns the response body to the caller, exposing internal service data or cloud‑provider credentials. This is a moderate‑severity vulnerability with a CVSS score of 7.1 and is quantified as CWE‑918.

The affected software is Flytohub Flyto‑Core. The CVE description explicitly states that version 2.26.3 includes the fix, so any release prior to 2.26.3 is vulnerable. Users running older versions should verify which release they are using and upgrade accordingly.

The CVSS score of 7.1 reflects a moderate risk with an authenticated attacker required to invoke the vulnerable API. The EPSS score is < 1%, indicating a very low but nonzero probability of exploitation. The vulnerability is not listed in CISA’s KEV catalog. Because the flaw allows the server to reach internal hosts, the potential impact includes disclosure of sensitive configuration or credentials. Exploitation requires only legitimate API access, so protecting the Execution API and upper‑layer authentication controls is critical. On a host that routes transition‑form addresses, the SSRF can reach local‑only or metadata‑service endpoints, making the attack valuable to attackers with legitimate or compromised credentials.