The flyto-core HTTP MCP endpoint (/mcp) exposes a JSON-RPC interface that accepts unauthenticated POST requests. Unlike other execution routes, this endpoint lacks authentication and module denylist enforcement. An attacker can invoke the execute_module tool with arbitrary module_id and parameters, including sandbox.execute_shell, which executes shell commands via asyncio.create_subprocess_shell without sanitization or restrictions. This allows unauthenticated remote command execution as the server process user. The default binding to 127.0.0.1 limits exposure to local attacks unless the server is started with --host 0.0.0.0, enabling remote exploitation. The vulnerability affects versions >=2.26.2 and <2.26.4 of flyto-core. No official patch or remediation is provided in the advisory.

An unauthenticated attacker can execute arbitrary operating system commands as the flyto-core server process. This can lead to full system compromise, data theft, or service disruption. When the server binds to localhost, exploitation requires local access, but if configured to bind to all network interfaces, remote exploitation is possible. The vulnerability has high confidentiality, integrity, and availability impact (CVSS 8.4 local).

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid running the flyto-core server with --host 0.0.0.0 to limit exposure to local access only. Restrict access to the server to trusted users and networks. Monitor vendor communications for patches or updates addressing this vulnerability.