Threats affecting pkg:github/flyto-core

Flyto2 Core versions prior to 2.28.0 contain a server-side request forgery (SSRF) vulnerability. This flaw allows attackers to bypass SSRF protections by using the IPv6 address ::, which the kernel routes to the loopback interface similarly to 0.0.0.0. By exploiting this, attackers can reach internal services that should be protected by private IP and hostname checks in the is_private_ip() function. The vulnerability affects the http.get, http.request, and http.batch modules. The issue is identified with a CVSS 4.0 score of 6.3, indicating medium severity.