CVE-2026-55786 in Flyto Core
Summary
by MITRE • 10/15/2026
Flyto2 Core is an execution kernel for automation and AI-agent workflows. From 2.26.2 until 2.26.4, the HTTP MCP POST /mcp route accepts unauthenticated JSON-RPC tools/call requests and forwards execute_module arguments to the module registry without the require_auth dependency used by the REST execution routes. An unauthenticated caller can select sandbox.execute_shell and supply its command parameter, which reaches asyncio.create_subprocess_shell with the privileges of the flyto-core server process. The endpoint is reachable locally under the default loopback binding and becomes network reachable when an operator binds the server to a non-loopback interface, allowing arbitrary OS command execution and potential full host compromise. This issue is fixed in version 2.26.4.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/15/2026
Flyto2 Core serves as an execution kernel designed for automation and artificial intelligence agent workflows, facilitating complex operational tasks through modular components. A critical security flaw was identified within the HTTP MCP POST /mcp route between versions 2.26.2 and 2.26.4 of this software suite. This specific endpoint is intended to handle JSON-RPC tool calls but suffers from a significant authentication bypass vulnerability due to inconsistent implementation of access control mechanisms across different execution pathways. While standard REST execution routes correctly enforce the require_auth dependency, the MCP route fails to apply equivalent checks before processing incoming requests.
The technical root cause lies in how the server handles arguments for specific modules when invoked through this unauthenticated endpoint. Specifically, an attacker can target the sandbox.execute_shell module by supplying a command parameter within the JSON-RPC payload. Because the authentication requirement is missing at this entry point, the system proceeds to forward these execute_module arguments directly to the internal module registry without validation of user identity or permissions. This architectural inconsistency allows any entity with network access to interact with sensitive execution functions that should be restricted to authorized users only.
The operational impact of this vulnerability is severe, leading to arbitrary operating system command execution on the host machine running the flyto-core server process. The flaw leverages asyncio.create_subprocess_shell to spawn new processes, granting the attacker the same privileges as the service account executing Flyto2 Core. If the operator has bound the server to a non-loopback interface for remote accessibility, this vulnerability becomes remotely exploitable over the network. Even in local-only configurations, it poses risks if other services or compromised accounts on the host can reach the loopback address. Successful exploitation enables an unauthenticated attacker to execute arbitrary commands, potentially leading to full host compromise, data exfiltration, lateral movement within the infrastructure, and complete loss of confidentiality, integrity, and availability for systems managed by Flyto2 Core.
This vulnerability aligns with CWE-862, which describes Missing Authorization, as the application fails to enforce proper access controls on a critical function. It also maps to MITRE ATT&CK technique T1059 Command and Scripting Interpreter, specifically shell command execution via subprocess creation, allowing attackers to leverage system utilities for malicious purposes. The issue was addressed in version 2.26.4 by ensuring that the require_auth dependency is consistently applied across all execution routes, including the MCP endpoint. Organizations running affected versions should immediately upgrade to the patched release and review network configurations to ensure sensitive services are not unnecessarily exposed on public or untrusted interfaces until remediation is complete.