---
id: CVE-2026-55786
title: Flyto2 Core is an execution kernel for automation and AI-agent workflows
summary: >-
  Flyto2 Core is an execution kernel for automation and AI-agent workflows. From
  2.26.2 until 2.26.4, the HTTP MCP POST /mcp route accepts unauthenticated
  JSON-RPC tools/call requests and forwards execute_module arguments to the
  module reg…
severity: high
cvss: 8.4
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-78
  - CWE-306
vendor: flyto-core
product: flyto-core
affected:
  - 'flyto-core >= 2.26.2, < 2.26.4'
patched:
  - flyto-core 2.26.4
published: '2026-10-14'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T20:04:29.760'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-55786'
references:
  - url: >-
      https://github.com/flytohub/flyto-core/commit/db7f116b1d3c5dcf94aded00d14118f81f3e225e
    label: security-advisories@github.com
  - url: 'https://github.com/flytohub/flyto-core/releases/tag/v2.26.4'
    label: security-advisories@github.com
  - url: >-
      https://github.com/flytohub/flyto-core/security/advisories/GHSA-h9f9-h6gm-wc85
    label: security-advisories@github.com
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-55786'
  - url: >-
      https://github.com/pypa/advisory-database/tree/main/vulns/flyto-core/PYSEC-2026-2482.yaml
  - url: 'https://github.com/advisories/GHSA-h9f9-h6gm-wc85'
  - url: 'https://github.com/flytohub/flyto-core'
tags:
  - nvd
  - ghsa
  - pip
  - cve.org
  - osv
epss: 0.00256
epssPercentile: 0.17113
aliases:
  - GHSA-h9f9-h6gm-wc85
  - PYSEC-2026-2482
ecosystem: pip
ingestedAt: '2026-07-06T17:44:51.390Z'
---

## Overview

Flyto2 Core is an execution kernel for automation and AI-agent workflows. From 2.26.2 until 2.26.4, the HTTP MCP POST /mcp route accepts unauthenticated JSON-RPC tools/call requests and forwards execute_module arguments to the module registry without the require_auth dependency used by the REST execution routes. An unauthenticated caller can select sandbox.execute_shell and supply its command parameter, which reaches asyncio.create_subprocess_shell with the privileges of the flyto-core server process. The endpoint is reachable locally under the default loopback binding and becomes network reachable when an operator binds the server to a non-loopback interface, allowing arbitrary OS command execution and potential full host compromise. This issue is fixed in version 2.26.4.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Package advisory (CVE-2026-55786)

Affected packages:

- `flyto-core >= 2.26.2, < 2.26.4`

Patched in:

- `flyto-core 2.26.4`

Source: https://github.com/advisories/GHSA-h9f9-h6gm-wc85