CVE-2026-62316

Received Received - Intake

Microsoft UFO Framework Command Execution Vulnerability

Publication date: 2026-08-21

Last updated on: 2026-08-21

Assigner: GitHub, Inc.

Description

Microsoft UFO open-source framework for intelligent automation across devices and platforms. Prior to 3.0.8, ufo/client/mcp/http_servers/linux_mcp_server.py binds a FastMCP streamable HTTP server to localhost:8010 but does not validate the Host, Origin, or Sec-Fetch-Site headers. An attacker-controlled web page can use DNS rebinding to reach the local /mcp endpoint, enumerate tool schemas through tools/list, and invoke execute_command with a valid UFO_MCP_API_KEY to read files or execute allowed operating system commands as the victim's user. This issue is fixed in version 3.0.8.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-21

Last Modified

2026-08-21

Generated

2026-08-22

AI Q&A

2026-08-22

EPSS Evaluated

N/A

NVD

CVE-2026-62316

EUVD

EUVD-2026-64136

Affected Vendors & Products

Vendor	Product	Version / Range
microsoft	ufo	to 3.0.8 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-200	The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
CWE-346	The product does not properly verify that the source of data or communication is valid.

Attack-Flow Graph

Executive Summary

This vulnerability affects the Microsoft UFO open-source framework before version 3.0.8. The issue is in the Linux MCP server component, which binds a FastMCP streamable HTTP server to localhost:8010 without validating critical HTTP headers like Host, Origin, or Sec-Fetch-Site. An attacker can exploit this by using DNS rebinding to bypass localhost restrictions, access the /mcp endpoint, and interact with the server.

Detection Guidance

Check if the UFO framework version is below 3.0.8 by running: ufo --version. Inspect network connections to localhost:8010 using netstat -tulnp | grep 8010 or ss -tulnp | grep 8010. Monitor for unexpected DNS rebinding attempts or unusual HTTP requests to /mcp or /tools/list endpoints.

Impact Analysis

If you use Microsoft UFO framework versions prior to 3.0.8, an attacker could trick you into visiting a malicious webpage. This page could then exploit DNS rebinding to reach your local /mcp endpoint. The attacker could enumerate available tools, read files, or execute OS commands on your system using your UFO_MCP_API_KEY privileges.

Compliance Impact

This vulnerability could lead to unauthorized file access or command execution on affected systems. For GDPR, this may constitute a breach if personal data is accessed. For HIPAA, it could violate protected health information safeguards. Organizations must ensure they are running patched versions to maintain compliance.

Mitigation Strategies

Upgrade the UFO framework to version 3.0.8 or later immediately. If upgrading is not possible, restrict access to localhost:8010 by using firewall rules to block external connections. Disable or remove the MCP server if not needed.

Hi! I’m here to help you understand CVE-2026-62316. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70