Findings

CVE-2026-55786

Flyto2 Core is an execution kernel for automation and AI-agent workflows.

Published Jul 6, 2026 · updated Oct 14, 2026

## Unauthenticated Command Execution via HTTP MCP ### Summary The HTTP MCP endpoint ( ) in flyto-core accepts unauthenticated JSON-RPC requests and dispatches them to arbitrary registered modules, including , which passes attacker-controlled input directly to . An unauthenticated attacker can execute arbitrary OS commands as the flyto-core server process. By default the server binds to , making this a High-severity local vulnerability (CVSS 8.4); if started with , it becomes remotely exploitable over the network. Dynamic reproduction confirmed command execution as inside a Docker container without any header. ### Details flyto-core exposes an HTTP API via FastAPI. When the API is started ( ), the MCP router is unconditionally mounted at ( ). The route handler at declares with **no** dependency, unlike the analogous REST execution routes ( ) which enforce both authentication and a module denylist. The complete unauthenticated data flow from source to sink: 1. ** ** — is mounted under unconditionally at app creation. 2. ** ** — has no guard; any HTTP client may POST to this route. 3. ** ** — the full request body (attacker-controlled JSON) is parsed without validation. 4. ** ** — each JSON-RPC item is forwarded to without a . 5. ** ** — with name forwards attacker-controlled and to . 6. ** , ** — the module registry resolves and invokes it with attacker-supplied . 7. ** ** — the function wrapper exposes as . 8. ** ** — is read directly from with no sanitization. 9. ** ** — reaches with and no allowlist or escaping. The module is not covered by the default denylist ( at ), so even if were applied it would still be reachable. **Vulnerable code excerpts:** **Contrast with the protected REST route:** The existence of authentication on the REST execution routes demonstrates that a security boundary was intended; the MCP route simply omits it. ### PoC **Environment setup (Docker):** **Exploit (curl) — no Authorization header:** **Exploit (Python PoC script):** **Observed re