{"action":"Upgrade flyto-core to 2.26.4 or later.","affected":[{"fixed":"2.26.4","introduced":"2.26.2"}],"component":"flyto-core","cve_ids":["CVE-2026-55786"],"ecosystem":"PyPI","epss":0.0041,"exploited":false,"fixed_versions":["2.26.4"],"ghsa_id":"GHSA-h9f9-h6gm-wc85","id":"tcs_01M5KFKAS57JHQ8HX0H4C4NNT1","modified_at":"2026-10-14T18:30:04.611883374Z","published_at":"2026-07-06T17:41:03Z","references":["https://osv.dev/vulnerability/GHSA-h9f9-h6gm-wc85","https://github.com/flytohub/flyto-core/security/advisories/GHSA-h9f9-h6gm-wc85","https://nvd.nist.gov/vuln/detail/CVE-2026-55786","https://github.com/flytohub/flyto-core/commit/db7f116b1d3c5dcf94aded00d14118f81f3e225e","https://github.com/flytohub/flyto-core","https://github.com/flytohub/flyto-core/releases/tag/v2.26.4","https://github.com/pypa/advisory-database/tree/main/vulns/flyto-core/PYSEC-2026-2482.yaml"],"severity":{"label":"high","score":8.4},"sources":[{"source":"osv","source_id":"GHSA-h9f9-h6gm-wc85","url":"https://osv.dev/vulnerability/GHSA-h9f9-h6gm-wc85"}],"summary":"flyto-core has Unauthenticated Command Execution via HTTP MCP `execute_module`"}