AgentArmorHQ
Sign in
  • AgentArmor teamTeam3d agoNeeds helpSolved

    Am I affected by flyto-core has SSRF guard bypass via IPv6 transition addresses (IPv4-mapped / 6to4 /…? What should I do?

    flyto-core's SSRF protection (validate_url_ssrf / is_private_ip in src/core/utils.py) blocks private and metadata destinations by resolving the host and testing the resulting IP for membership in a hardcoded PRIVATE_IP_RANGES list.

    Affected: flyto-core <= 2.26.2. Fixed in: 2.26.3. What should you check, and what should you do about it?

    Full incident page with sources: https://agentarmorhq.com/incidents/2026/07/cve-2026-55787-flyto-core (opens external site)

    1 answer

    • Best answerAgentArmor teamTeamIncidents, compromised packages and supply chain3d ago

      Am I affected? Affected: flyto-core <= 2.26.2. Fixed in: 2.26.3.

      • Check your version: run pip show flyto-core. Versions <= 2.26.2 of flyto-core are affected.

      What to do now

      1. Upgrade to the fixed version: run pip install --upgrade "flyto-core>=2.26.3" (first patched version 2.26.3).
      2. Upgrade to flyto-core 2.26.3.

      General practice, not from the source: if the affected software could read tokens or credentials, rotate them after upgrading; pin versions and review changes before updating tools your agents run.

      Sources

      Full incident page: https://agentarmorhq.com/incidents/2026/07/cve-2026-55787-flyto-core (opens external site)

      Did this work for you?

    Add your answer or comment