Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-81735— UI-TARS-desktop @agent-infra MCP Servers Bind Every Interface Without Authentication, Exposing Arbitrary Command Execution

Quick assessment

Affected
bytedance UI-TARS-desktop
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Bytedance TARS是中国Bytedance公司的一款桌面智能体应用。 Bytedance TARS c2ad42e3eb9b27830db41a3e6f51ca7179d9b168之前版本存在授权问题漏洞，该漏洞源于startServer.ts默认将监听地址设为'::'且认证中间件可选，可能导致未经身份验证的攻击者通过网络访问端口，执行任意命令或读写文件。

CVSS 10.0 · Critical EPSS 0.78% · P55

Affected Version Matrix 2

VendorProduct Version RangeStatus
bytedance UI-TARS-desktop c2ad42e3eb9b27830db41a3e6f51ca7179d9b168 unaffected
< c2ad42e3eb9b27830db41a3e6f51ca7179d9b168 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-81735

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
UI-TARS-desktop @agent-infra MCP Servers Bind Every Interface Without Authentication, Exposing Arbitrary Command Execution
Source: CVE Program / CVE List V5
Vulnerability Description
startServer.ts in the mcp-http-server package of UI-TARS-desktop defaulted its listen address to '::' when no host was given, so startSseAndStreamableHttpMcpServer bound the Streamable HTTP and SSE MCP transports to every interface, and its authentication middleware was optional: middlewares are applied only when a caller supplies them. The @agent-infra/mcp-server-commands and @agent-infra/mcp-server-filesystem entry points call startSseAndStreamableHttpMcpServer with a host and port alone and pass no middleware, so neither server required a credential. The commands server exposes a run_command tool that hands its caller-supplied command string to promisify(child_process.exec), so any unauthenticated client able to reach the port could run arbitrary commands as the user running the server, and the filesystem server exposed its file read and write tools on the same terms. The listen default became 127.0.0.1 in commit c2ad42e3eb9b27830db41a3e6f51ca7179d9b168; the package version stayed at 1.2.4 across that change, so the boundary is the commit rather than a release.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
关键功能的认证机制缺失
Source: CVE Program / CVE List V5
Vulnerability Title
Bytedance TARS 授权问题漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Bytedance TARS是中国Bytedance公司的一款桌面智能体应用。 Bytedance TARS c2ad42e3eb9b27830db41a3e6f51ca7179d9b168之前版本存在授权问题漏洞，该漏洞源于startServer.ts默认将监听地址设为'::'且认证中间件可选，可能导致未经身份验证的攻击者通过网络访问端口，执行任意命令或读写文件。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
bytedance UI-TARS-desktop 0 ~ c2ad42e3eb9b27830db41a3e6f51ca7179d9b168 -

II. Public POCs for CVE-2026-81735

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-81735

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-81735 (2)

Vendor Advisories for CVE-2026-81735 (1)

Other References for CVE-2026-81735 (1)

IV. Related Vulnerabilities

Same vendor: bytedance
Same weakness: CWE-306

V. Comments for CVE-2026-81735

No comments yet

Leave a comment