Executive brief
flyto-core, a library used for building AI-driven applications, contains a security flaw in its communication interface. An attacker can send specially crafted messages to the server to execute arbitrary commands on the underlying operating system without needing a password. This could lead to a complete takeover of the server, allowing unauthorized access to sensitive data or the ability to disrupt operations.
Technical details
The HTTP Model Context Protocol (MCP) endpoint (`POST /mcp`) in flyto-core fails to implement authentication checks, unlike other REST routes. The endpoint accepts JSON-RPC `tools/call` requests and dispatches them to registered modules. Specifically, the `execute_module` tool can be used to invoke the `sandbox.execute_shell` module, which passes unsanitized attacker input directly to `asyncio.create_subprocess_shell`. While the server binds to the loopback interface by default (local attack vector), it is remotely exploitable if configured to listen on all interfaces. The vulnerability allows full system compromise with the privileges of the server process (e.g., root). A fix is available in version 2.26.4.
Affected products
- flytohub flyto-core >= 2.26.2, < 2.26.4
Timeline
- 2026-05-30: disclosed
- 2026-07-06: advisory: GHSA-h9f9-h6gm-wc85 published
- 2026-07-06: patched: Version 2.26.4 released