Flyto Core before version 2.28.0 contains a server‑side request forgery guard bypass that allows attackers to reach internal services by supplying URLs with the unblocked IPv6 address ‘::’. The kernel routes this address to the loopback interface, mimicking the behavior of 0.0.0.0, and thus bypasses the private IP range and blocked hostname checks performed in is_private_ip(). Attackers can submit requests or trigger 302 redirects to these addresses, enabling access to services bound to the IPv6 loopback through the http.get, http.request, and http.batch modules. This flaw allows an attacker to read or modify data on internal services, potentially compromising confidentiality and integrity of back‑end resources.

The affected product is Flytohub Flyto Core for all releases prior to 2.28.0. The versioning information is indicated in the advisory title; any build earlier than 2.28.0 is vulnerable.

The base CVSS score of 6.3 indicates moderate severity. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog, suggesting no confirmed public exploitation at this time. The attack vector is a standard HTTP request to a specially crafted URL and does not require additional privileges or local access. Because the flaw enables access to internal services via the IPv6 loopback, the potential impact on an organization’s internal network is significant, but the exposure depends on the network topology and firewall protections in place.