{"metadata": {"vulnerability": "CVE-2026-55786", "count": 21, "kinds": {"milestone": 5, "sighting": 3, "kev": 5, "other": 8}}, "data": [{"timestamp": "2026-06-17T14:40:28.380Z", "date_only": false, "value": "2026-06-17T14:40:28.380Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-55786", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-07-06T17:41:03Z", "date_only": false, "value": "2026-07-06T17:41:03Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-H9F9-H6GM-WC85", "record": "GHSA-H9F9-H6GM-WC85", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-07-06T18:35:06.719Z", "date_only": false, "value": "2026-07-06T18:35:06.719418Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://github.com/flytohub/flyto-core/security/advisories/GHSA-h9f9-h6gm-wc85", "record": "CVE-2026-55786", "field": "creation_timestamp", "uuid": "cddc823e-3e2f-40e5-8f90-b6c010f3b9ac", "url": "https://github.com/flytohub/flyto-core/security/advisories/GHSA-h9f9-h6gm-wc85", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2026-07-13T15:46:28.370Z", "date_only": false, "value": "2026-07-13T15:46:28.370322Z", "kind": "milestone", "label": "Published", "source": "pysec \u00b7 PYSEC-2026-2482", "record": "PYSEC-2026-2482", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-07-13T16:04:05.020Z", "date_only": false, "value": "2026-07-13T16:04:05.020135Z", "kind": "other", "label": "Updated", "source": "pysec \u00b7 PYSEC-2026-2482", "record": "PYSEC-2026-2482", "field": "modified"}, {"timestamp": "2026-09-14T07:22:25Z", "date_only": false, "value": "2026-09-14T07:22:25+00:00", "kind": "kev", "label": "Asserted", "source": "previdian", "record": "CVE-2026-55786", "field": "timestamps.asserted_at", "metric_role": "exploitation_report", "metric_basis": "kev_report", "uuid": "6f56f80c-36af-4820-aa8f-11300f96eb05", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-09-14T07:22:25Z", "date_only": false, "value": "2026-09-14T07:22:25+00:00", "kind": "kev", "label": "First seen", "source": "previdian", "record": "CVE-2026-55786", "field": "timestamps.first_seen_at", "metric_role": "exploitation_report", "metric_basis": "kev_report", "uuid": "6f56f80c-36af-4820-aa8f-11300f96eb05", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-09-14T07:22:25Z", "date_only": false, "value": "2026-09-14T07:22:25+00:00", "kind": "kev", "label": "Status updated", "source": "previdian", "record": "CVE-2026-55786", "field": "status.status_updated_at", "uuid": "6f56f80c-36af-4820-aa8f-11300f96eb05", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-09-14T07:22:25.586Z", "date_only": false, "value": "2026-09-14T07:22:25.586Z", "kind": "kev", "label": "Catalog added", "source": "previdian", "record": "CVE-2026-55786", "field": "evidence.0.details.added_date", "uuid": "6f56f80c-36af-4820-aa8f-11300f96eb05", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-09-15T08:00:01Z", "date_only": false, "value": "2026-09-15T08:00:01+00:00", "kind": "kev", "label": "Recorded", "source": "previdian", "record": "CVE-2026-55786", "field": "timestamps.recorded_at", "metric_role": "exploitation_report", "metric_basis": "kev_report", "uuid": "6f56f80c-36af-4820-aa8f-11300f96eb05", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-09-15T08:00:37.281Z", "date_only": false, "value": "2026-09-15T08:00:37.281885Z", "kind": "sighting", "label": "Exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/6f56f80c-36af-4820-aa8f-11300f96eb05", "record": "CVE-2026-55786", "field": "creation_timestamp", "uuid": "607bb211-c561-43f7-ac37-ee47dbc740a7", "url": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/6f56f80c-36af-4820-aa8f-11300f96eb05", "metric_role": "exploitation", "metric_basis": "sighting_report"}, {"timestamp": "2026-10-14T18:14:39.210Z", "date_only": false, "value": "2026-10-14T18:14:39.210Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-55786", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-10-14T18:14:39.210Z", "date_only": false, "value": "2026-10-14T18:14:39.210Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / GitHub_M", "record": "CVE-2026-55786", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-14T18:15:45Z", "date_only": false, "value": "2026-10-14T18:15:45Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-H9F9-H6GM-WC85", "record": "GHSA-H9F9-H6GM-WC85", "field": "modified"}, {"timestamp": "2026-10-14T19:17:17.777Z", "date_only": false, "value": "2026-10-14T19:17:17.777", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-55786", "record": "FKIE_CVE-2026-55786", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-10-14T23:40:30.290Z", "date_only": false, "value": "2026-10-14T23:40:30.290750Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117441903305079361", "record": "CVE-2026-55786", "field": "creation_timestamp", "uuid": "ac2c76a0-11a4-488c-8dd8-3f46967b178d", "content": "CVE-2026-55786 Flyto2 Core: Unauthenticated Command Execution via HTTP MCP `execute_module` Flyto2 Core is an execution kernel for automation and AI-agent workflows. From 2.26.2 until 2.26.4, the HTTP MCP POST /mcp route accepts unauthenticated JSON-RPC tools/call requests and forwards execute_module arguments to the module registry without the require_auth dependency used by the REST execution routes. An unauthenticated caller can select sandbox.execute_shell and supply its command parameter, which reaches asyncio.create_subprocess_shell with the privileges of the flyto-core server process. The endpoint is reachable locally under the default loopback binding and becomes network reachable when an operator binds the server to a non-loopback interface, allowing arbitrary OS command execution and potential full host compromise. This issue is fixed in version 2.26.4.\nhttps://www.cve.org/CVERecord?id=CVE-2026-55786https://github.com/flytohub/flyto-core/security/advisories/GHSA-h9f9-h6gm-wc85https://github.com/flytohub/flyto-core/commit/db7f116b1d3c5dcf94aded00d14118f81f3e225ehttps://github.com/flytohub/flyto-core/releases/tag/v2.26.4#flytohub #flyto-core#CVE_2026_55786#bot", "url": "https://infosec.exchange/users/cve/statuses/117441903305079361"}, {"timestamp": "2026-10-29T13:49:05.403Z", "date_only": false, "value": "2026-10-29T13:49:05.403752Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-55786", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-10-29T13:49:05.403Z", "date_only": false, "value": "2026-10-29T13:49:05.403752Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-55786", "record": "FKIE_CVE-2026-55786", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2026-10-29T13:49:14.344Z", "date_only": false, "value": "2026-10-29T13:49:14.344Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-55786", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-10-29T13:49:14.344Z", "date_only": false, "value": "2026-10-29T13:49:14.344Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-55786", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-29T14:17:57.017Z", "date_only": false, "value": "2026-10-29T14:17:57.017", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-55786", "record": "FKIE_CVE-2026-55786", "field": "lastModified"}], "metrics": {"as_of": "2026-11-02T08:43:34.756Z", "anchors": {"origin": {"timestamp": "2026-07-06T17:41:03Z", "date_only": false, "value": "2026-07-06T17:41:03Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-H9F9-H6GM-WC85", "record": "GHSA-H9F9-H6GM-WC85", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "discovery": null, "report": null, "acknowledgement": null, "disclosure": {"timestamp": "2026-07-06T17:41:03Z", "date_only": false, "value": "2026-07-06T17:41:03Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-H9F9-H6GM-WC85", "record": "GHSA-H9F9-H6GM-WC85", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "exploit_publication": {"timestamp": "2026-07-06T18:35:06.719Z", "date_only": false, "value": "2026-07-06T18:35:06.719418Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://github.com/flytohub/flyto-core/security/advisories/GHSA-h9f9-h6gm-wc85", "record": "CVE-2026-55786", "field": "creation_timestamp", "uuid": "cddc823e-3e2f-40e5-8f90-b6c010f3b9ac", "url": "https://github.com/flytohub/flyto-core/security/advisories/GHSA-h9f9-h6gm-wc85", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, "exploitation": {"timestamp": "2026-09-14T07:22:25Z", "date_only": false, "value": "2026-09-14T07:22:25+00:00", "kind": "kev", "label": "Asserted", "source": "previdian", "record": "CVE-2026-55786", "field": "timestamps.asserted_at", "metric_role": "exploitation_report", "metric_basis": "kev_report", "uuid": "6f56f80c-36af-4820-aa8f-11300f96eb05", "status": {"status_reason": "confirmed", "exploited": true}}, "patch": null}, "vendor_response_time": {"available": false, "missing": ["start", "end"]}, "time_to_exploit": {"available": true, "seconds": 6010882.0, "hours": 1669.6894444444445, "days": 69.57039351851851, "min_seconds": 6010882.0, "max_seconds": 6010882.0, "approximate": false, "ongoing": false, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-07-06T17:41:03Z", "date_only": false, "value": "2026-07-06T17:41:03Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-H9F9-H6GM-WC85", "record": "GHSA-H9F9-H6GM-WC85", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-09-14T07:22:25Z", "date_only": false, "value": "2026-09-14T07:22:25+00:00", "kind": "kev", "label": "Asserted", "source": "previdian", "record": "CVE-2026-55786", "field": "timestamps.asserted_at", "metric_role": "exploitation_report", "metric_basis": "kev_report", "uuid": "6f56f80c-36af-4820-aa8f-11300f96eb05", "status": {"status_reason": "confirmed", "exploited": true}}}, "disclosure_to_exploit": {"available": true, "seconds": 6010882.0, "hours": 1669.6894444444445, "days": 69.57039351851851, "min_seconds": 6010882.0, "max_seconds": 6010882.0, "approximate": false, "ongoing": false, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-07-06T17:41:03Z", "date_only": false, "value": "2026-07-06T17:41:03Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-H9F9-H6GM-WC85", "record": "GHSA-H9F9-H6GM-WC85", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-09-14T07:22:25Z", "date_only": false, "value": "2026-09-14T07:22:25+00:00", "kind": "kev", "label": "Asserted", "source": "previdian", "record": "CVE-2026-55786", "field": "timestamps.asserted_at", "metric_role": "exploitation_report", "metric_basis": "kev_report", "uuid": "6f56f80c-36af-4820-aa8f-11300f96eb05", "status": {"status_reason": "confirmed", "exploited": true}}}, "disclosure_to_exploit_publication": {"available": true, "seconds": 3243.719, "hours": 0.9010330555555556, "days": 0.037543043981481485, "min_seconds": 3243.719, "max_seconds": 3243.719, "approximate": false, "ongoing": false, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-07-06T17:41:03Z", "date_only": false, "value": "2026-07-06T17:41:03Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-H9F9-H6GM-WC85", "record": "GHSA-H9F9-H6GM-WC85", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-07-06T18:35:06.719Z", "date_only": false, "value": "2026-07-06T18:35:06.719418Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://github.com/flytohub/flyto-core/security/advisories/GHSA-h9f9-h6gm-wc85", "record": "CVE-2026-55786", "field": "creation_timestamp", "uuid": "cddc823e-3e2f-40e5-8f90-b6c010f3b9ac", "url": "https://github.com/flytohub/flyto-core/security/advisories/GHSA-h9f9-h6gm-wc85", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}}, "time_to_patch": {"available": false, "missing": ["start", "end"]}, "total_time_to_patch": {"available": false, "missing": ["start", "end"]}, "disclosure_to_patch": {"available": false, "missing": ["end"]}, "time_unpatched": {"available": true, "seconds": 10249351.756582, "hours": 2847.042154606111, "days": 118.62675644192129, "min_seconds": 10249351.756582, "max_seconds": 10249351.756582, "approximate": false, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-07-06T17:41:03Z", "date_only": false, "value": "2026-07-06T17:41:03Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-H9F9-H6GM-WC85", "record": "GHSA-H9F9-H6GM-WC85", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-11-02T08:43:34.756Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}, "exploitation_to_patch": {"available": true, "seconds": 4238469.756582, "hours": 1177.3527101616667, "days": 49.05636292340278, "min_seconds": 4238469.756582, "max_seconds": 4238469.756582, "approximate": false, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-09-14T07:22:25Z", "date_only": false, "value": "2026-09-14T07:22:25+00:00", "kind": "kev", "label": "Asserted", "source": "previdian", "record": "CVE-2026-55786", "field": "timestamps.asserted_at", "metric_role": "exploitation_report", "metric_basis": "kev_report", "uuid": "6f56f80c-36af-4820-aa8f-11300f96eb05", "status": {"status_reason": "confirmed", "exploited": true}}, "end": {"timestamp": "2026-11-02T08:43:34.756Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}, "exploit_publication_to_patch": {"available": true, "seconds": 10246108.037582, "hours": 2846.141121550556, "days": 118.58921339793983, "min_seconds": 10246108.037582, "max_seconds": 10246108.037582, "approximate": false, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-07-06T18:35:06.719Z", "date_only": false, "value": "2026-07-06T18:35:06.719418Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://github.com/flytohub/flyto-core/security/advisories/GHSA-h9f9-h6gm-wc85", "record": "CVE-2026-55786", "field": "creation_timestamp", "uuid": "cddc823e-3e2f-40e5-8f90-b6c010f3b9ac", "url": "https://github.com/flytohub/flyto-core/security/advisories/GHSA-h9f9-h6gm-wc85", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, "end": {"timestamp": "2026-11-02T08:43:34.756Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}}}