An authenticated Server-Side Request Forgery vulnerability in flyto-core allows attackers to force the server to make unauthorized requests to internal resources.

The software is susceptible to Server-Side Request Forgery (SSRF) due to improper validation of user-supplied input. This vulnerability requires the attacker to be authenticated to the system before they can craft malicious requests to internal network services.

An attacker can use this vulnerability to probe internal network segments, bypass firewalls, or interact with services that are not exposed to the public internet. With a CVSS score of 8.5, this high-severity flaw could lead to lateral movement within the network and the compromise of internal infrastructure.

Immediate Action: Update flyto-core to version 2.26.7 or later to patch the SSRF input validation logic.

Proactive Monitoring: Audit application logs for suspicious outbound requests originating from the flyto-core server, especially those targeting local or private IP ranges.

Compensating Controls: Restrict the application server's network access to only necessary internal services using host-based firewalls or network segmentation.

Public Exploit Available: Unknown

This SSRF vulnerability presents a clear path for internal network reconnaissance and potential compromise. Organizations must apply the 2.26.7 update promptly and ensure that the principle of least privilege is applied to service accounts interacting with the core kernel to limit the blast radius of a potential compromise.