CVE-2026-108721
Received Received - Intake

Improper Case Sensitivity Handling in Open Computer Use on macOS

Publication date: 2026-10-11

Last updated on: 2026-10-11

Assigner: VulnCheck

Description
Open Computer Use through 1.0.0 on macOS contains an improper case sensitivity handling vulnerability that allows local MCP callers to bypass the password-manager denylist using case-variant bundle identifiers. Attackers, including prompt-injected model turns, can pass identifiers like com.1Password.1Password to get_app_state and action tools to read accessibility trees, capture screenshots, and drive unlocked password manager interfaces.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-11
Last Modified
2026-10-11
Generated
2026-10-11
AI Q&A
2026-10-11
EPSS Evaluated
N/A
NVD
CVE-2026-108721
EUVD
EUVD-2026-96995

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
iFurySt open-computer-use 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-178 The product does not properly account for differences in case sensitivity when accessing or determining the properties of a resource, leading to inconsistent results.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Open Computer Use 1.0.0 on macOS has an improper case sensitivity handling flaw. Local MCP callers can bypass the password-manager denylist by using case-variant bundle identifiers like com.1Password.1Password. This allows attackers to interact with password manager interfaces and access sensitive data.

Detection Guidance

This vulnerability involves improper case sensitivity handling in Open Computer Use on macOS. To detect it, check for applications using case-variant bundle identifiers like com.1Password.1Password. Review system logs for unusual MCP caller activity or unauthorized access to password managers.

Impact Analysis

An attacker with local access could exploit this to read accessibility trees, capture screenshots, or drive unlocked password manager interfaces. This may lead to unauthorized access to stored passwords or sensitive information.

Compliance Impact

This vulnerability could lead to unauthorized access to personal or sensitive data, potentially violating GDPR (data protection) and HIPAA (health information privacy) requirements. Organizations may face compliance penalties if exploited.

Mitigation Strategies

Update Open Computer Use to the latest version if available. Restrict local MCP caller permissions and review denylist configurations. Disable accessibility features for password managers if not needed and monitor for suspicious activity.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-108721. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart