Unauthenticated Command Execution in Flyto2 Core Automation Kernel

CVE-2026-55786

What is CVE-2026-55786?

Flyto2 Core versions 2.26.2 to 2.26.4 are susceptible to an unauthenticated command execution vulnerability. The HTTP MCP POST /mcp route accepts JSON-RPC requests without authentication, enabling attackers to execute OS commands using the privileges of the Flyto2 Core server process. This vulnerability can be exploited if the server is accessible over a network instead of being limited to localhost, potentially leading to full host compromise. Users are advised to upgrade to version 2.26.4 where this issue has been resolved.

References