Flytohub Flyto Core up to 2.26.3 MCP Endpoint asyncio.create_subprocess_shell command os command injection

Summaryinfo

A vulnerability classified as very critical was found in Flytohub Flyto Core up to 2.26.3. This impacts the function asyncio.create_subprocess_shell of the component MCP Endpoint. Such manipulation of the argument command leads to os command injection. This vulnerability is listed as CVE-2026-55786. The attack may be performed from remote. There is no available exploit. Upgrading the affected component is advised.

Detailsinfo

A vulnerability was found in Flytohub Flyto Core up to 2.26.3. It has been rated as very critical. Affected by this issue is the function asyncio.create_subprocess_shell of the component MCP Endpoint. The manipulation of the argument command with an unknown input leads to a os command injection vulnerability. Using CWE to declare the problem leads to CWE-78. The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component. Impacted is confidentiality, integrity, and availability. CVE summarizes:

Flyto2 Core is an execution kernel for automation and AI-agent workflows. From 2.26.2 until 2.26.4, the HTTP MCP POST /mcp route accepts unauthenticated JSON-RPC tools/call requests and forwards execute_module arguments to the module registry without the require_auth dependency used by the REST execution routes. An unauthenticated caller can select sandbox.execute_shell and supply its command parameter, which reaches asyncio.create_subprocess_shell with the privileges of the flyto-core server process. The endpoint is reachable locally under the default loopback binding and becomes network reachable when an operator binds the server to a non-loopback interface, allowing arbitrary OS command execution and potential full host compromise. This issue is fixed in version 2.26.4.

The advisory is shared for download at github.com. This vulnerability is handled as CVE-2026-55786 since 06/17/2026. The exploitation is known to be easy. The attack may be launched remotely. No form of authentication is required for exploitation. There are known technical details, but no exploit is available. The current price for an exploit might be approx. USD $0-$5k (estimation calculated on 10/14/2026). The MITRE ATT&CK project declares the attack technique as T1202.

Upgrading to version 2.26.4 eliminates this vulnerability.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Vendor

• Flytohub

Name

• Flyto Core

Version

• 2.26.0
• 2.26.1
• 2.26.2
• 2.26.3

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion