What happened
Verified via NVD REST API (CVE-2026-55786 published 2026-10-14, CVSS 8.4, CWE-78/306; CVE-2026-55787 CVSS 7.1, CWE-918). The kernel's own MCP route skips the auth dependency applied to REST execution routes, exposing command execution to any caller who can reach the endpoint; fixed in 2.26.4 (and 2.26.3 for the SSRF).
Why it matters
An AI-agent execution kernel failing to authenticate its MCP tool surface is the textbook agentic-infrastructure failure: the component whose whole job is to run agent commands must never expose sandbox.execute_shell unauthenticated. Operators binding to non-loopback interfaces are directly at risk of full-host RCE from any network peer.
Attack vector
Unauthenticated JSON-RPC tools/call to the HTTP MCP POST /mcp route — the route forwards execute_module arguments (e.g. sandbox.execute_shell with a command parameter) to the module registry without the require_auth dependency used by the REST routes; the command reaches asyncio.create_subprocess_shell with server-process privileges. The SSRF sibling bypasses private-IP checks using IPv4-mapped/6to4/NAT64 transition-form literals to reach loopback/metadata.
Affected systems
flyto-core 2.26.2–<2.26.4 (RCE); <2.26.3 (SSRF CVE-2026-55787)
Mitigation
Upgrade flyto-core to >= 2.26.4 (2.26.3 for SSRF), keep the MCP route bound to loopback behind an authenticated proxy, and audit the module registry for require_auth coverage.