PyPI/flyto-core CVE-2026-55786: high 8.4, EPSS 0.26%

flyto-core has Unauthenticated Command Execution via HTTP MCP `execute_module`

Action: Upgrade flyto-core to 2.26.4 or later.

pip install flyto-core==2.26.4

Affected

Fixed versions

Sources

• osv: PYSEC-2026-2482
• https://github.com/flytohub/flyto-core/security/advisories/GHSA-h9f9-h6gm-wc85
• https://github.com/flytohub/flyto-core
• https://pypi.org/project/flyto-core
• https://github.com/advisories/GHSA-h9f9-h6gm-wc85
• https://nvd.nist.gov/vuln/detail/CVE-2026-55786

CVE-2026-55786 · published 2026-07-13T15:46:28.370322Z · modified 2026-07-13T16:31:47.496592699Z · JSON