CVE-2026-73530 is an SSRF vulnerability in flytohub's flyto-core product before version 2.28.0. The vulnerability arises because the SSRF guard does not block requests using the IPv6 address ::, which the kernel treats as loopback, effectively bypassing private IP range and hostname checks implemented in the is_private_ip() function. This allows attackers to submit requests or trigger 302 redirects to internal services bound to the IPv6 loopback interface via the http.get, http.request, and http.batch modules. No official remediation or patch information is currently available.

An attacker with low privileges can exploit this vulnerability to bypass SSRF protections and access internal services bound to the IPv6 loopback interface. This could lead to unauthorized internal network access, potentially exposing sensitive internal resources or services that are otherwise protected by private IP and hostname checks. The CVSS 4.0 base score is 6.3, reflecting a medium severity impact without requiring user interaction or elevated privileges beyond low privileges.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting or monitoring usage of the http.get, http.request, and http.batch modules for requests involving IPv6 loopback addresses. Avoid relying solely on is_private_ip() for SSRF protection against IPv6 loopback addresses. Follow vendor updates closely for an official patch or mitigation.