Server-side Request Forgery (SSRF) Affecting flyto-core package, versions [,2.26.3)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applicationsSnyk Learn
Learn about Server-side Request Forgery (SSRF) vulnerabilities in an interactive lesson.
Start learning- Snyk IDSNYK-PYTHON-FLYTOCORE-17824487
- published6 Jul 2026
- disclosed6 Jul 2026
- creditUnknown
Introduced: 6 Jul 2026
CVE-2026-55787 (opens in a new tab)Common Vulnerabilities and Exposures (CVE) are common identifiers for publicly known security vulnerabilities
Common Weakness Enumeration (CWE) is a category system for software weaknesses
How to fix?
Upgrade flyto-core to version 2.26.3 or higher.
Overview
flyto-core is an A workflow engine with 412 built-in modules. Trace every step. Replay from any point.
Affected versions of this package are vulnerable to Server-side Request Forgery (SSRF) in the validate_url_ssrf process. An attacker can access internal or sensitive resources by submitting specially crafted URLs containing IPv6 transition addresses that bypass IP range checks, resulting in the exfiltration of data from internal services.