Description
startServer.ts in the mcp-http-server package of UI-TARS-desktop defaulted its listen address to '::' when no host was given, so startSseAndStreamableHttpMcpServer bound the Streamable HTTP and SSE MCP transports to every interface, and its authentication middleware was optional: middlewares are applied only when a caller supplies them. The @agent-infra/mcp-server-commands and @agent-infra/mcp-server-filesystem entry points call startSseAndStreamableHttpMcpServer with a host and port alone and pass no middleware, so neither server required a credential. The commands server exposes a run_command tool that hands its caller-supplied command string to promisify(child_process.exec), so any unauthenticated client able to reach the port could run arbitrary commands as the user running the server, and the filesystem server exposed its file read and write tools on the same terms. The listen default became 127.0.0.1 in commit c2ad42e3eb9b27830db41a3e6f51ca7179d9b168; the package version stayed at 1.2.4 across that change, so the boundary is the commit rather than a release.
Published: 2026-08-27
Score: 10 Critical
EPSS: < 1% Very Low
KEV: No
Impact: Arbitrary command execution via unauthenticated client
Action: Immediate Patch
AI Analysis

Impact

The @agent-infra/mcp-http-server components in UI-TARS-desktop default to listening on all network interfaces when the host parameter is omitted. Authentication middleware is applied only when supplied, so the command and filesystem services expose a run_command function that forwards raw command strings to child_process.exec. A remote attacker can therefore connect to the exposed ports and execute arbitrary system commands as the user running the server, leading to complete remote code execution and full compromise of confidentiality, integrity, and availability.

Affected Systems

Bytedance's UI-TARS-desktop, specifically the mcp-http-server package, is affected. Versions 1.2.4 and any package that does not include the commit c2ad42e3 (which changes the default bind address to 127.0.0.1) retain the vulnerable behavior. The vulnerability is present in any deployment where the service is reachable from an external network, regardless of the operating system or container environment.

Risk and Exploitability

The CVSS score of 10 reflects a critical, unattended remote code execution risk. The EPSS score is currently unavailable, but the vulnerability is not listed in CISA's KEV catalog, indicating no confirmed widespread exploitation yet. Nevertheless, the unprotected network interface and lack of authentication make the attack vector trivial for an attacker who can reach the exposed ports, and organizations should treat the issue as a high-priority remediation.

Generated by OpenCVE AI on August 27, 2026 at 18:42 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Update UI-TARS-desktop to a revision that includes the commit c2ad42e3 or a subsequent release that sets the default bind address to 127.0.0.1.
  • Configure the mcp-http-server to bind explicitly to a trusted interface and enable authentication middleware, ensuring the host and port parameters are supplied and not omitted.
  • Implement firewall rules or reverse‑proxy restrictions to block external access to the affected ports, limiting exposure to internal or restricted networks.

Generated by OpenCVE AI on August 27, 2026 at 18:42 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 31 Aug 2026 19:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Fri, 28 Aug 2026 16:45:00 +0000

Type Values Removed Values Added
First Time appeared Bytedance
Bytedance ui-tars-desktop
Vendors & Products Bytedance
Bytedance ui-tars-desktop

Thu, 27 Aug 2026 16:45:00 +0000

Type Values Removed Values Added
Description startServer.ts in the mcp-http-server package of UI-TARS-desktop defaulted its listen address to '::' when no host was given, so startSseAndStreamableHttpMcpServer bound the Streamable HTTP and SSE MCP transports to every interface, and its authentication middleware was optional: middlewares are applied only when a caller supplies them. The @agent-infra/mcp-server-commands and @agent-infra/mcp-server-filesystem entry points call startSseAndStreamableHttpMcpServer with a host and port alone and pass no middleware, so neither server required a credential. The commands server exposes a run_command tool that hands its caller-supplied command string to promisify(child_process.exec), so any unauthenticated client able to reach the port could run arbitrary commands as the user running the server, and the filesystem server exposed its file read and write tools on the same terms. The listen default became 127.0.0.1 in commit c2ad42e3eb9b27830db41a3e6f51ca7179d9b168; the package version stayed at 1.2.4 across that change, so the boundary is the commit rather than a release.
Title UI-TARS-desktop @agent-infra MCP Servers Bind Every Interface Without Authentication, Exposing Arbitrary Command Execution
Weaknesses CWE-306
References
Metrics cvssV3_1

{'score': 10, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H'}

cvssV4_0

{'score': 10, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H'}

Subscriptions

Bytedance Ui-tars-desktop
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-08-31T18:14:39.625Z

Reserved: 2026-08-27T11:29:11.283Z

Link: CVE-2026-81735

cve-icon Vulnrichment

Updated: 2026-08-31T18:14:34.078Z

cve-icon NVD

Status : Received

Published: 2026-08-27T17:21:03.677

Modified: 2026-08-31T19:17:15.000

Link: CVE-2026-81735

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-28T16:14:16Z

Weaknesses
  • CWE-306

    Missing Authentication for Critical Function