Executive brief
Microsoft UFO is an open-source intelligent automation framework that runs a local HTTP server for executing system commands and file operations. Prior to version 3.0.8, the server fails to validate request headers, allowing an attacker-controlled web page to bypass origin restrictions via DNS rebinding, enumerate available operations, and execute arbitrary file reads or OS commands using a valid API key. This could lead to unauthorized access to sensitive files and system compromise.
Technical details
The vulnerability is a DNS rebinding attack combined with missing Host/Origin/Sec-Fetch-Site header validation in the FastMCP HTTP server (linux_mcp_server.py) listening on localhost:8010. An attacker can host a malicious web page that performs DNS rebinding to reach the local /mcp endpoint, call tools/list to enumerate available command schemas, and invoke execute_command with a valid UFO_MCP_API_KEY to read arbitrary files or execute whitelisted OS commands as the authenticated user. The attack requires either knowledge of a valid UFO_MCP_API_KEY or exploitation of a related authentication bypass. This issue is fixed in version 3.0.8 by implementing proper header validation and per-command argument policies.
Affected products
- Microsoft UFO prior to 3.0.8
Timeline
- 2026-08-21: disclosed
- 2026-08-10: patched: Fixed in version 3.0.8