CVE-2026-81735
Received Received - Intake

Remote Code Execution in UI-TARS-desktop MCP Server

Publication date: 2026-08-27

Last updated on: 2026-08-27

Assigner: VulnCheck

Description
startServer.ts in the mcp-http-server package of UI-TARS-desktop defaulted its listen address to '::' when no host was given, so startSseAndStreamableHttpMcpServer bound the Streamable HTTP and SSE MCP transports to every interface, and its authentication middleware was optional: middlewares are applied only when a caller supplies them. The @agent-infra/mcp-server-commands and @agent-infra/mcp-server-filesystem entry points call startSseAndStreamableHttpMcpServer with a host and port alone and pass no middleware, so neither server required a credential. The commands server exposes a run_command tool that hands its caller-supplied command string to promisify(child_process.exec), so any unauthenticated client able to reach the port could run arbitrary commands as the user running the server, and the filesystem server exposed its file read and write tools on the same terms. The listen default became 127.0.0.1 in commit c2ad42e3eb9b27830db41a3e6f51ca7179d9b168; the package version stayed at 1.2.4 across that change, so the boundary is the commit rather than a release.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-27
Last Modified
2026-08-27
Generated
2026-08-27
AI Q&A
2026-08-27
EPSS Evaluated
N/A
NVD
CVE-2026-81735
EUVD
EUVD-2026-67078

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
bytedance ui-tars-desktop 1.2.4
bytedance mcp-http-server 1.2.4
bytedance agent-infra mcp-server-commands
bytedance agent-infra mcp-server-filesystem

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-306 The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-81735 is a critical vulnerability in the UI-TARS-desktop application's MCP servers. The mcp-http-server package's startServer.ts file defaulted its listen address to all network interfaces ('::') when no host was specified. This caused the Streamable HTTP and SSE MCP transports to bind to every interface without requiring authentication. The authentication middleware was optional, so no credentials were needed to access the servers. The @agent-infra/mcp-server-commands and @agent-infra/mcp-server-filesystem entry points called the vulnerable function without middleware, exposing arbitrary command execution and file read/write capabilities to unauthenticated clients.

Detection Guidance

Check if the mcp-http-server is listening on all interfaces by running netstat -tulnp | grep node or ss -tulnp | grep node. Look for processes binding to '::' or '0.0.0.0' on ports used by the MCP servers. Verify if authentication is enforced by inspecting server configurations for middleware settings.

Impact Analysis

Unauthenticated attackers able to reach the affected port could execute arbitrary commands on the server as the user running it via the run_command tool. They could also read or write files on the system through the exposed filesystem server tools. Since the server initially bound to all interfaces, this risk extended to any network the server was connected to, not just localhost.

Compliance Impact

This vulnerability likely violates compliance requirements for data protection and access control. It enables unauthorized command execution and file access, which could lead to data breaches or unauthorized system modifications. GDPR requires protecting personal data and ensuring proper access controls, while HIPAA mandates safeguards for protected health information. This vulnerability would fail to meet these standards due to the lack of authentication and excessive network exposure.

Mitigation Strategies

Update to the latest commit where the default host is set to 127.0.0.1. If updating is not possible, manually configure the server to bind only to localhost. Ensure authentication middleware is enabled for all MCP servers. Block external access to MCP server ports using firewalls.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-81735. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart