CVE-2026-55786

Deferred Deferred - Pending Action

Command Injection in Flyto2 Core

Publication date: 2026-10-14

Last updated on: 2026-10-16

Assigner: GitHub, Inc.

Description

Flyto2 Core is an execution kernel for automation and AI-agent workflows. From 2.26.2 until 2.26.4, the HTTP MCP POST /mcp route accepts unauthenticated JSON-RPC tools/call requests and forwards execute_module arguments to the module registry without the require_auth dependency used by the REST execution routes. An unauthenticated caller can select sandbox.execute_shell and supply its command parameter, which reaches asyncio.create_subprocess_shell with the privileges of the flyto-core server process. The endpoint is reachable locally under the default loopback binding and becomes network reachable when an operator binds the server to a non-loopback interface, allowing arbitrary OS command execution and potential full host compromise. This issue is fixed in version 2.26.4.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-16

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-55786

EUVD

EUVD-2026-101589

Affected Vendors & Products

Vendor	Product	Version / Range
flytohub	flyto-core	>= 2.26.2, < 2.26.4

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-306	The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.
CWE-78	The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Attack-Flow Graph

Executive Summary

CVE-2026-55786 is a high-severity vulnerability in Flyto2 Core versions 2.26.2 to 2.26.4. It allows unauthenticated attackers to execute arbitrary OS commands on the server hosting the software. The flaw exists in the HTTP MCP POST /mcp route, which forwards user-controlled input to the sandbox.execute_shell module without authentication checks. This module then passes the input to asyncio.create_subprocess_shell with shell=True, enabling command execution with the privileges of the flyto-core server process.

By default, the server binds to 127.0.0.1, making this a local attack vector. However, if the server is configured to bind to 0.0.0.0, the vulnerability becomes remotely exploitable over the network. Exploitation requires no authentication or user interaction.

Detection Guidance

Check if the flyto-core server is running on versions 2.26.2 to 2.26.3. Inspect network traffic for unauthenticated POST requests to the /mcp endpoint. Look for suspicious shell command execution logs or processes spawned by the flyto-core process.

Impact Analysis

This vulnerability allows attackers to execute arbitrary OS commands with the privileges of the flyto-core server process. This can lead to full system compromise, including file read/write operations, credential theft, lateral movement within networks, and complete host takeover. Attackers could install malware, exfiltrate sensitive data, or pivot to other systems in the network.

Compliance Impact

This vulnerability likely violates compliance requirements for GDPR and HIPAA due to unauthorized access and potential data breaches. GDPR mandates strict access controls and breach notification, while HIPAA requires protection of sensitive health data. Exploitation could result in unauthorized data access, leading to regulatory fines and legal consequences.

Mitigation Strategies

Upgrade flyto-core to version 2.26.4 or later. Ensure the server is bound only to loopback interfaces (127.0.0.1) unless authentication is enforced. Add authentication dependencies to the MCP route and update the denylist to block sandbox.* modules.

Hi! I’m here to help you understand CVE-2026-55786. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70