CVE-2026-55786
8.4HighPublished 14 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
- Impact
- Full C/I/A compromise
- Weakness
- CWE-78, CWE-306
Impact
Attackers can execute arbitrary shell commands with the privileges of the flyto-core server process, potentially compromising the host. Local attackers can exploit this by default, and network attackers can reach it if the server is bound to a non-loopback interface.
Root cause
The HTTP MCP POST /mcp route accepts unauthenticated JSON-RPC requests and passes commands directly to asyncio.create_subprocess_shell without enforcing authentication dependencies.
Affected systems
Flyto2 Core versions 2.26.2 through 2.26.3 (fixed in 2.26.4)
CVSS v3.1 · CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Fix & remediation
Upgrade flyto-core to version 2.26.4 immediately. If patching must wait, ensure the server is strictly bound to the loopback interface (127.0.0.1) and block external network access to the HTTP MCP port.
$ pip install --upgrade flyto-core==2.26.4AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
Flyto2 Core is an execution kernel for automation and AI-agent workflows. From 2.26.2 until 2.26.4, the HTTP MCP POST /mcp route accepts unauthenticated JSON-RPC tools/call requests and forwards execute_module arguments to the module registry without the require_auth dependency used by the REST execution routes. An unauthenticated caller can select sandbox.execute_shell and supply its command parameter, which reaches asyncio.create_subprocess_shell with the privileges of the flyto-core server process. The endpoint is reachable locally under the default loopback binding and becomes network reachable when an operator binds the server to a non-loopback interface, allowing arbitrary OS command execution and potential full host compromise. This issue is fixed in version 2.26.4.