CVE-2026-55786

Name of the Vulnerable Software and Affected Versions flyto-core version 2.26.2

Description An unauthenticated OS command injection exists in the HTTP MCP endpoint. The endpoint POST /mcp accepts JSON-RPC tools/call requests without authentication and dispatches them to registered modules. Specifically, the execute module function allows an attacker to specify a module id of sandbox.execute shell and provide a command variable within the params object. This input is passed directly to asyncio.create subprocess shell with shell=True and no sanitization, allowing arbitrary command execution with the privileges of the server process. By default, the server binds to 127.0.0.1, but if started with --host 0.0.0.0, it is remotely exploitable.

Recommendations For version 2.26.2, implement the require auth dependency on the POST /mcp and DELETE /mcp routes to enforce authentication. For version 2.26.2, apply the module filter to the handle jsonrpc request function calls within the MCP route handler. For version 2.26.2, add sandbox.* to the DEFAULT DENYLIST in the security configuration to prevent access to the sandbox shell module. As a temporary mitigation, restrict the server binding to the loopback interface and avoid using the --host 0.0.0.0 flag.