A high-severity Server-Side Request Forgery vulnerability in flytohub flyto-core allows low-privileged authenticated users to potentially access internal resources.

The flaw is a Server-Side Request Forgery (CWE-918) vulnerability. It requires low-level authentication (PR:L) to trigger, allowing an attacker to coerce the application into making unauthorized outbound requests to internal infrastructure.

The exploitation of this vulnerability could lead to the exposure of sensitive internal services or metadata that are otherwise protected by a network perimeter. With a CVSS score of 8.5, this high-severity flaw poses a significant risk of data exfiltration or internal network reconnaissance, potentially leading to a broader compromise of the organization's automation workflows.

Immediate Action: Upgrade to flyto-core version 2.26.7 or higher to incorporate the necessary security fixes.

Proactive Monitoring: Review application access logs for unusual outbound traffic patterns or requests directed toward internal IP addresses or sensitive local ports.

Compensating Controls: Implement strict egress filtering on the host running the flyto-core kernel to restrict outbound network connections to known, authorized destinations.

Public Exploit Available: false

Given the high CVSS score, organizations should prioritize the update to version 2.26.7 across all deployments. Immediate patching is the most effective way to eliminate the SSRF risk and prevent unauthorized access to internal network resources.