flyto-core has Unauthenticated Command Execution via HTTP MCP `execute_module`

Unauthenticated Command Execution via HTTP MCP executemodule SummaryThe HTTP MCP endpoint POST /mcp in flyto-core accepts unauthenticated JSON-RPC tools/call requests and dispatches them to arbitrary registered modules, including sandbox.executeshell, which passes attacker-controlled input direct...

The vulnerabilities in the modules drivers/gpu/drm/xe/xe_exec.c, drivers/gpu/drm/xe/xe_vm.c, and include/uapi/drm/xe_drm.h of the Linux operating system’s kernel allow a hacker to trigger a service failure.

The vulnerabilities in the drivers/gpu/drm/xe/xeexec.c, drivers/gpu/drm/xe/xevm.c, and include/uapi/drm/xedrm.h modules of the Linux operating system are related to unlimited resource allocation. Exploiting these vulnerabilities can allow an attacker to cause service failures...