Unrated

Authenticated SSRF in flyto-core HTTP-capable modules

IdentifiersCVE-2026-55787CWE-918

flyto-core contains a server-side request forgery vulnerability in multiple HTTP-capable modules that issue outbound requests to fully user-controlled URLs without invoking the project's SSRF validation routine, validate_url_with_env_config. The flaw affects modules that perform direct HTTP requests while relying only on non-enforcing metadata indicating SSRF protection rather than actually applying destination validation before network access. Reported affected modules include core.api.http_get, core.api.http_post, GraphQL request modules, monitoring and notification modules, certain AI and browser-related modules, and inline base_url handling paths. The root cause is an inconsistent, per-module SSRF protection model with no centralized guarded outbound HTTP client, allowing vulnerable modules to bypass intended destination restrictions entirely. Successful exploitation allows an authenticated workflow author to direct the application to access loopback, RFC1918, cloud metadata, and other internal network resources and receive the remote response content back through the application.

For your environment

Are you exposed to this one?

Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.

Start free trial

ANALYST BRIEF

Impact, mitigation & remediation

What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.

Impact

What an attacker gets, and what they’ve been doing with it.

The vulnerability enables readable SSRF from the application environment into internal and otherwise restricted network locations. An attacker can query loopback services, private-addressed hosts, internal APIs, and cloud instance metadata endpoints, with the application returning response status, headers, and body to the caller. This can expose sensitive internal data, enable theft of cloud IAM or instance credentials from metadata services, and potentially permit interaction with internal-only administrative or service APIs. Because the application crosses trust boundaries on behalf of the attacker, the impact scope extends beyond the vulnerable component to reachable internal infrastructure.

Mitigation

If you can’t patch tonight, do this now.

Until a fix is deployed, restrict access to workflow-authoring and execution functionality to highly trusted users, and disable or limit untrusted workflows that can invoke outbound-request modules. Apply network-layer egress controls to block access from the application environment to cloud metadata services, loopback, link-local, and RFC1918/internal address space where operationally feasible. If the platform supports destination allowlisting, constrain outbound requests to explicitly approved hosts or services only. Additional compensating controls include reducing module exposure through policy controls and monitoring for unexpected outbound requests to internal network ranges.

Remediation

Patch, then assume compromise.

Upgrade to a vendor-fixed release once available. The reported corrective action is to enforce validate_url_with_env_config on every module that accepts user-controlled URLs before issuing outbound requests, or preferably to centralize all outbound HTTP behavior behind a single guarded client wrapper so future modules inherit SSRF validation automatically. Review all HTTP-emitting modules for equivalent direct request paths and ensure destination validation is mandatory rather than represented only by metadata or documentation tags.

PUBLIC EXPLOITS

Exploits

No public exploits tracked yet. Mallory keeps watching.

VALID 0 / 0 TOTALView more in app

No public exploit code observed for this vulnerability.

ACTIVITY FEED

Recent activity

1 sources tracked across advisories and community write-ups. News coverage will land here when it surfaces.

1 SOURCESView more in app

No news coverage yet. Advisories and community discussion only.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which adversaries are exploiting it right now, which detections to deploy, and what to do tonight.

Start free trial

Exposure mapping

Query your assets running an affected version, and investigate the blast radius.

Threat actor evidence

Every observed campaign linking this CVE to a named adversary.

Associated malware

Malware families riding this exploit, with evidence and IOCs.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Vendor-by-vendor mapping

Cross-references every affected SKU, including bundled OEM variants.

Social activity