Technical impact
The vulnerability is a Server Side Request Forgery flaw that occurs when the Flyto2 Core HTTP modules follow redirects without revalidating each hop. An attacker can supply a publicly reachable URL that redirects into internal network addresses; because the modules bypass Location header checks, the final internal response body is returned to the attacker. This allows unauthorized retrieval of internal data and, depending on internal services, could lead to broader attacks such as lateral movement or internal privilege escalation. The weakness is categorized as CWE‑918.
Affected Systems
The affected product is Flytohub Flyto Core, versions prior to 2.26.7. The issue exists in the http.get, http.request, and http.batch modules bundled within that kernel. If an organization runs Flyto Core below v2.26.7, its automation workflows that invoke these HTTP modules are vulnerable.
Risk and Exploitability
The CVSS score of 8.5 signals high severity. The EPSS score of less than 1 % indicates a very low probability of exploitation, and the vulnerability is not listed in CISA’s KEV catalog. However, the attack path requires an attacker to control a redirect location, which is feasible if an application or platform can be tricked into making external HTTP requests. The absence of per‑hop validation means the flaw can be leveraged to read from any internal endpoint that the application can reach.
Github GHSA