CVE-2026-55786: Flyto2 Core: Unauthenticated command execution via HTTP MCP endpoint

Summary

Flyto2 Core, an execution kernel for automation and AI-agent workflows, accepts unauthenticated JSON-RPC tools/call requests on the HTTP MCP POST /mcp route. An unauthenticated caller can invoke the sandbox.execute_shell module through execute_module and run arbitrary operating system commands with the privileges of the flyto-core server process, which may lead to full host compromise. The endpoint is reachable locally under the default loopback binding and from the network when the server is bound to a non-loopback interface.

Affected

flyto-core (PyPI) from 2.26.2 up to, but not including, 2.26.4
Vendor data: affected versions 2.26.2 to 2.26.4 (exclusive)
VulDB lists the range as up to 2.26.3 (worded differently, consistent with the fix)

Fixed in

Fixed in version 2.26.4 (vendor release v2.26.4)

Workaround

Unknown. The vendor documents no workaround; upgrading to 2.26.4 or later is the fix.

Exploitation

CISA SSVC: exploitation status PoC, automatable no, technical impact total
CISA KEV: not listed
A public proof of concept appears to exist; its origin has not been verified
In-the-wild exploitation: unknown
CVSS 3.1 vector is local (AV:L) per the CNA; VulDB scores it 10.0 Critical

Our recommendation

Upgrade every flyto-core instance to version 2.26.4 or later, starting with network-reachable or shared-host instances
Keep the server bound to 127.0.0.1 and block its port at the firewall
Do not expose /mcp through a reverse proxy
Run the service under a low-privilege account
If an instance was network-reachable while vulnerable, review logs for unexpected POST /mcp requests and treat the host as potentially compromised until checked
Verify the version data against the primary GitHub advisory, as it was not opened directly

Public exploits

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

CVE record fix commit (GitHub) github.com
flyto-core release v2.26.4 github.com
GHSA-h9f9-h6gm-wc85 vendor advisory github.com
GitLab advisory CVE-2026-55786 advisories.gitlab.com
OSV GHSA-h9f9-h6gm-wc85 osv.dev
VulDB entry 420308 vuldb.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 12:25.

Original description (NVD)

Flyto2 Core is an execution kernel for automation and AI-agent workflows. From 2.26.2 until 2.26.4, the HTTP MCP POST /mcp route accepts unauthenticated JSON-RPC tools/call requests and forwards execute_module arguments to the module registry without the require_auth dependency used by the REST execution routes. An unauthenticated caller can select sandbox.execute_shell and supply its command parameter, which reaches asyncio.create_subprocess_shell with the privileges of the flyto-core server process. The endpoint is reachable locally under the default loopback binding and becomes network reachable when an operator binds the server to a non-loopback interface, allowing arbitrary OS command execution and potential full host compromise. This issue is fixed in version 2.26.4.

NVD references (4)

Sources

The tracker combines official, freely usable data sources – updated continuously:

NVD (NIST) – CVEs, rating (CVSS), affected products
CISA KEV – vulnerabilities confirmed by CISA as actively exploited
CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
FIRST EPSS – probability of exploitation
Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
PoC-in-GitHub – public proof-of-concept repositories
Metasploit (Rapid7) – modules of the Metasploit Framework
Exploit-DB (OffSec) – archive of public exploits (links only)
Patch days: official vendor pages (linked per vendor) (Vendor patch days)

Affected? We can help.

We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.

Get in touch RSS feed