Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-81735— UI-TARS-desktop @agent-infra MCP Servers Bind Every Interface Without Authentication, Exposing Arbitrary Command Execution

Quick assessment

Affected
bytedance UI-TARS-desktop
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

项目中 包的 在未指定主机名时，默认将监听地址设置为 （即所有网络接口）。因此， 将 Streamable HTTP 和 SSE 两种 MCP 传输层绑定到了所有网络接口上，且其认证中间件是可选的：只有当调用者显式传入中间件时，中间件才会生效。 和 这两个入口点调用 时仅传入了 host 和 port，但未传入任何中间件。因此，这两个服务器均无需凭证即可访问。 其中， 服务器暴露了一个 工具，该工具会将调用者提供的命令字符串直接传递给 执行。因此，任何能够访问该端口的未认证客户端都可以以运行服务器用户的身份执行任意

CVSS 10.0 · Critical
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-81735

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
UI-TARS-desktop @agent-infra MCP Servers Bind Every Interface Without Authentication, Exposing Arbitrary Command Execution
Source: CVE Program / CVE List V5
Vulnerability Description
startServer.ts in the mcp-http-server package of UI-TARS-desktop defaulted its listen address to '::' when no host was given, so startSseAndStreamableHttpMcpServer bound the Streamable HTTP and SSE MCP transports to every interface, and its authentication middleware was optional: middlewares are applied only when a caller supplies them. The @agent-infra/mcp-server-commands and @agent-infra/mcp-server-filesystem entry points call startSseAndStreamableHttpMcpServer with a host and port alone and pass no middleware, so neither server required a credential. The commands server exposes a run_command tool that hands its caller-supplied command string to promisify(child_process.exec), so any unauthenticated client able to reach the port could run arbitrary commands as the user running the server, and the filesystem server exposed its file read and write tools on the same terms. The listen default became 127.0.0.1 in commit c2ad42e3eb9b27830db41a3e6f51ca7179d9b168; the package version stayed at 1.2.4 across that change, so the boundary is the commit rather than a release.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
关键功能的认证机制缺失
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
bytedance UI-TARS-desktop 0 ~ c2ad42e3eb9b27830db41a3e6f51ca7179d9b168 -

II. Public POCs for CVE-2026-81735

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-81735

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-81735 (2)

Vendor Advisories for CVE-2026-81735 (1)

Other References for CVE-2026-81735 (1)

IV. Related Vulnerabilities

Same vendor: bytedance
Same weakness: CWE-306

V. Comments for CVE-2026-81735

No comments yet

Leave a comment