CVE-2026-55786High· 8.4▾ TwilightFlyto2 Core is an execution kernel for automation and AI-agent workflows. From 2.26.2 until 2.26.4, the HTTP MCP POST /mcp route accepts unauthenticated JSON-RPC tools/call requests and forwards execute_module arguments to the module reg…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 46.2 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Oct 16.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
0.3%
Flyto2 Core is an execution kernel for automation and AI-agent workflows. From 2.26.2 until 2.26.4, the HTTP MCP POST /mcp route accepts unauthenticated JSON-RPC tools/call requests and forwards execute_module arguments to the module registry without the require_auth dependency used by the REST execution routes. An unauthenticated caller can select sandbox.execute_shell and supply its command parameter, which reaches asyncio.create_subprocess_shell with the privileges of the flyto-core server process. The endpoint is reachable locally under the default loopback binding and becomes network reachable when an operator binds the server to a non-loopback interface, allowing arbitrary OS command execution and potential full host compromise. This issue is fixed in version 2.26.4.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Affected packages:
flyto-core >= 2.26.2, < 2.26.4Patched in:
flyto-core 2.26.4Connected by shared product, vendor, weakness, or advisory.
CVE-2026-67426Critical· 9.3Flyto2 Core: Unauthenticated flyto-verification /run: callback_url SSRF and internal runner-secret exfiltration
CVE-2026-55787High· 7.1Flyto2 Core is an execution kernel for automation and AI-agent workflows
CVE-2026-67429Critical· 10.0Flyto2 Core: Arbitrary file write via image.download (and other file-writing modules)
CVE-2026-67427High· 8.6Flyto2 Core: ${env.VAR} interpolation reads any env secret despite env.get being denylisted
CVE-2026-67425High· 8.6Flyto2 Core: LLM/API keys leak to an attacker-controlled base_url
CVE-2026-67428High· 8.5Flyto2 Core: Multiple HTTP-family modules fetch client-controlled URLs without the SSRF guard their siblings apply (SSRF to internal/metadata)