NVD HIGH: CVE-2026-73530 — Flyto2 Core before 2.28.0 contains a server-side request forgery guard bypass vu...
Flyto2 Core before 2.28.0 contains a server-side request forgery guard bypass vulnerability that allows attackers to reach internal services by supplying URLs using the unblocked IPv6 address `::` which the kernel routes to loopback identically to `0.0.0.0`. Attackers can submit requests or trigger 302 redirects to ` to bypass the private IP range and blocked hostname checks in `is_private_ip()`,
CVE-2026-73530