{"metadata": {"vulnerability": "CVE-2026-55787", "count": 15, "kinds": {"milestone": 5, "sighting": 2, "kev": 0, "other": 8}, "linked_omitted": 0}, "data": [{"timestamp": "2026-06-17T14:40:28.380Z", "date_only": false, "value": "2026-06-17T14:40:28.380Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-55787", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-07-06T17:30:34Z", "date_only": false, "value": "2026-07-06T17:30:34Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-794R-5RP2-FPG8", "record": "GHSA-794R-5RP2-FPG8", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-07-06T17:30:34Z", "date_only": false, "value": "2026-07-06T17:30:34Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-794R-5RP2-FPG8", "record": "GHSA-794R-5RP2-FPG8", "field": "modified", "linked_record": true}, {"timestamp": "2026-07-06T18:35:08.939Z", "date_only": false, "value": "2026-07-06T18:35:08.939431Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://github.com/flytohub/flyto-core/security/advisories/GHSA-794r-5rp2-fpg8", "record": "CVE-2026-55787", "field": "creation_timestamp", "uuid": "1330bacb-b38d-4909-b2a0-9144869ef04f", "url": "https://github.com/flytohub/flyto-core/security/advisories/GHSA-794r-5rp2-fpg8", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2026-07-13T15:46:28.276Z", "date_only": false, "value": "2026-07-13T15:46:28.276574Z", "kind": "milestone", "label": "Published", "source": "pysec \u00b7 PYSEC-2026-2481", "record": "PYSEC-2026-2481", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-07-13T16:04:04.936Z", "date_only": false, "value": "2026-07-13T16:04:04.936950Z", "kind": "other", "label": "Updated", "source": "pysec \u00b7 PYSEC-2026-2481", "record": "PYSEC-2026-2481", "field": "modified", "linked_record": true}, {"timestamp": "2026-10-14T18:13:52.454Z", "date_only": false, "value": "2026-10-14T18:13:52.454Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-55787", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-10-14T18:13:52.454Z", "date_only": false, "value": "2026-10-14T18:13:52.454Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / GitHub_M", "record": "CVE-2026-55787", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-14T19:17:17.927Z", "date_only": false, "value": "2026-10-14T19:17:17.927", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-55787", "record": "FKIE_CVE-2026-55787", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-10-14T23:41:10.548Z", "date_only": false, "value": "2026-10-14T23:41:10.548267Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117441905950975783", "record": "CVE-2026-55787", "field": "creation_timestamp", "uuid": "e8ecbd11-aa5c-4956-a89b-313b08bf58d1", "content": "CVE-2026-55787 Flyto2 Core: SSRF guard bypass via IPv6 transition addresses (IPv4-mapped / 6to4 / NAT64) in validate_url_ssrf Flyto2 Core is an execution kernel for automation and AI-agent workflows. Prior to 2.26.3, validate_url_ssrf and is_private_ip in src/core/utils.py compare resolved addresses only against native private IPv4 and IPv6 ranges and do not unwrap IPv4-mapped, IPv4-compatible, 6to4, or NAT64 transition addresses. An authenticated workflow author can provide a transition-form literal URL through the Execution API POST /v1/execute route, http.get, or sibling guarded outbound-request modules, causing the guard to accept an address whose embedded IPv4 points to loopback, RFC 1918, or cloud metadata services. On a host that routes the selected transition form, the outbound request reaches the internal destination and returns the response body to the workflow caller, enabling read SSRF and disclosure of internal-service data or cloud credentials. This issue is fixed in version 2.26.3.\nhttps://www.cve.org/CVERecord?id=CVE-2026-55787https://github.com/flytohub/flyto-core/security/advisories/GHSA-794r-5rp2-fpg8https://github.com/flytohub/flyto-core/pull/20https://github.com/flytohub/flyto-core/commit/519e040384a74984848c4e84a6600e5f1020a6d2https://github.com/flytohub/flyto-core/releases/tag/v2.26.3#flytohub #flyto-core#CVE_2026_55787#bot", "url": "https://infosec.exchange/users/cve/statuses/117441905950975783"}, {"timestamp": "2026-10-15T14:54:19.186Z", "date_only": false, "value": "2026-10-15T14:54:19.186468Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-55787", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-10-15T14:54:19.186Z", "date_only": false, "value": "2026-10-15T14:54:19.186468Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-55787", "record": "FKIE_CVE-2026-55787", "field": "metrics.ssvcV203.0.ssvcData.timestamp", "linked_record": true}, {"timestamp": "2026-10-15T14:55:23.673Z", "date_only": false, "value": "2026-10-15T14:55:23.673Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-55787", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-10-15T14:55:23.673Z", "date_only": false, "value": "2026-10-15T14:55:23.673Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-55787", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-16T20:04:29.760Z", "date_only": false, "value": "2026-10-16T20:04:29.760", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-55787", "record": "FKIE_CVE-2026-55787", "field": "lastModified", "linked_record": true}], "metrics": {"as_of": "2026-11-12T01:00:25.711Z", "anchors": {"origin": {"timestamp": "2026-07-06T17:30:34Z", "date_only": false, "value": "2026-07-06T17:30:34Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-794R-5RP2-FPG8", "record": "GHSA-794R-5RP2-FPG8", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, "discovery": null, "report": null, "acknowledgement": null, "disclosure": {"timestamp": "2026-07-06T17:30:34Z", "date_only": false, "value": "2026-07-06T17:30:34Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-794R-5RP2-FPG8", "record": "GHSA-794R-5RP2-FPG8", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, "exploit_publication": {"timestamp": "2026-07-06T18:35:08.939Z", "date_only": false, "value": "2026-07-06T18:35:08.939431Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://github.com/flytohub/flyto-core/security/advisories/GHSA-794r-5rp2-fpg8", "record": "CVE-2026-55787", "field": "creation_timestamp", "uuid": "1330bacb-b38d-4909-b2a0-9144869ef04f", "url": "https://github.com/flytohub/flyto-core/security/advisories/GHSA-794r-5rp2-fpg8", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, "exploitation": null, "patch": null}, "vendor_response_time": {"available": false, "missing": ["start", "end"]}, "time_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit_publication": {"available": true, "seconds": 3874.939, "hours": 1.0763719444444444, "days": 0.04484883101851852, "min_seconds": 3874.939, "max_seconds": 3874.939, "approximate": false, "ongoing": false, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-07-06T17:30:34Z", "date_only": false, "value": "2026-07-06T17:30:34Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-794R-5RP2-FPG8", "record": "GHSA-794R-5RP2-FPG8", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, "end": {"timestamp": "2026-07-06T18:35:08.939Z", "date_only": false, "value": "2026-07-06T18:35:08.939431Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://github.com/flytohub/flyto-core/security/advisories/GHSA-794r-5rp2-fpg8", "record": "CVE-2026-55787", "field": "creation_timestamp", "uuid": "1330bacb-b38d-4909-b2a0-9144869ef04f", "url": "https://github.com/flytohub/flyto-core/security/advisories/GHSA-794r-5rp2-fpg8", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}}, "time_to_patch": {"available": false, "missing": ["start", "end"]}, "total_time_to_patch": {"available": false, "missing": ["start", "end"]}, "disclosure_to_patch": {"available": false, "missing": ["end"]}, "time_unpatched": {"available": true, "seconds": 11086191.711996, "hours": 3079.497697776667, "days": 128.31240407402777, "min_seconds": 11086191.711996, "max_seconds": 11086191.711996, "approximate": false, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-07-06T17:30:34Z", "date_only": false, "value": "2026-07-06T17:30:34Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-794R-5RP2-FPG8", "record": "GHSA-794R-5RP2-FPG8", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, "end": {"timestamp": "2026-11-12T01:00:25.711Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}, "exploitation_to_patch": {"available": false, "missing": ["start"]}, "exploit_publication_to_patch": {"available": true, "seconds": 11082316.772996, "hours": 3078.421325832222, "days": 128.26755524300924, "min_seconds": 11082316.772996, "max_seconds": 11082316.772996, "approximate": false, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-07-06T18:35:08.939Z", "date_only": false, "value": "2026-07-06T18:35:08.939431Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://github.com/flytohub/flyto-core/security/advisories/GHSA-794r-5rp2-fpg8", "record": "CVE-2026-55787", "field": "creation_timestamp", "uuid": "1330bacb-b38d-4909-b2a0-9144869ef04f", "url": "https://github.com/flytohub/flyto-core/security/advisories/GHSA-794r-5rp2-fpg8", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, "end": {"timestamp": "2026-11-12T01:00:25.711Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}}}