The flaw resides in Flyto2 Core’s HTTP MCP POST /mcp interface, which accepts unauthenticated JSON‑RPC calls and forwards execute_module arguments to the module registry without requiring authentication. An attacker can invoke sandbox.execute_shell and provide a command string that is passed to asyncio.create_subprocess_shell with the privileges of the flyto‑core server process. This permits arbitrary operating system command execution and potentially full compromise of the host.

The vulnerability affects flytohub’s Flyto-core product, specifically versions 2.26.2 through 2.26.3, which are known to lack the authentication guard that newer releases provide. The issue was remedied in version 2.26.4, which implements proper access control on the HTTP MCP route.

With a CVSS score of 8.4, the vulnerability is considered high severity. Although no EPSS score is available, the flaw permits unauthenticated exploitation from the local machine by default, and becomes remote‑exploitable if the server is bound to a non‑loopback interface. The vulnerability is not listed in the CISA KEV catalog, but the lack of authentication and the ability to spawn commands make it a significant risk to both local and potentially remote attackers who can reach the exposed endpoint.