The vulnerability resides in the UFO Framework’s Linux MCP HTTP server which binds to localhost:8010 and does not verify DNS‑relevant headers such as Host, Origin or Sec‑Fetch‑Site, allowing an attacker who controls a web page to perform DNS rebinding; the attacker can enumerate tool schemas and invoke the execute_command endpoint using a valid UFO_MCP_API_KEY, thereby reading arbitrary files or executing permitted system commands as the victim’s user, corresponding to CWE-200 (Information Exposure) and CWE-346 (Missing Access Control).

Any installation of the Microsoft UFO open‑source framework with a version older than 3.0.8 is affected, specifically the ufo/client/mcp/http_servers/linux_mcp_server.py component of the UFO framework; users running these older versions on local or networked environments are at risk.

The CVSS score of 8.8 indicates high severity, while the EPSS score is not provided and the vulnerability is not listed in CISA KEV; the attack vector is inferred to be a remote or web‑based scenario where an attacker serves a malicious page that an authorized user visits, using DNS rebinding to reach the local endpoint and exploit the missing header validation.