CVE-2026-55786 | Flytohub Flyto Core up to 2.26.3 MCP Endpoint asyncio.create_subprocess_shell command os command injection

October 14, 2026 Yanac

A vulnerability classified as very critical has been found in Flytohub Flyto Core up to 2.26.3. This affects the function asyncio.create_subprocess_shell of the component MCP Endpoint. This manipulation of the argument command causes os command injection.

This vulnerability is tracked as CVE-2026-55786. The attack is possible to be carried out remotely. No exploit exists.

It is recommended to upgrade the affected component.VulDB Recent EntriesRead More