{"action":"Upgrade flyto-core to 2.26.4 or later.","affected":[{"fixed":"2.26.4","introduced":"2.26.2"}],"component":"flyto-core","cve_ids":["CVE-2026-55786"],"ecosystem":"PyPI","epss":0.00256,"exploited":false,"fixed_versions":["2.26.4"],"ghsa_id":"GHSA-h9f9-h6gm-wc85","id":"tcs_01M5KGZR61D88QZ7PASAGCGWDT","modified_at":"2026-07-13T16:31:47.496592699Z","published_at":"2026-07-13T15:46:28.370322Z","references":["https://osv.dev/vulnerability/PYSEC-2026-2482","https://github.com/flytohub/flyto-core/security/advisories/GHSA-h9f9-h6gm-wc85","https://github.com/flytohub/flyto-core","https://pypi.org/project/flyto-core","https://github.com/advisories/GHSA-h9f9-h6gm-wc85","https://nvd.nist.gov/vuln/detail/CVE-2026-55786"],"severity":{"label":"high","score":8.4},"sources":[{"source":"osv","source_id":"PYSEC-2026-2482","url":"https://osv.dev/vulnerability/PYSEC-2026-2482"}],"summary":"flyto-core has Unauthenticated Command Execution via HTTP MCP `execute_module`"}