Executive brief
UI-TARS-desktop's MCP HTTP server binds to all network interfaces by default and lacks required authentication, allowing unauthenticated remote clients to access command execution and file read/write tools. An attacker on the network can run arbitrary OS commands or modify files with the privileges of the server process, leading to full system compromise.
Technical details
The mcp-http-server package in UI-TARS-desktop defaults its listen address to '::' (IPv6 all-interfaces) when no host is specified, binding the HTTP MCP transport to every interface. Authentication middleware is optional and only applied if explicitly provided by the caller; the @agent-infra/mcp-server-commands and @agent-infra/mcp-server-filesystem entry points invoke startSseAndStreamableHttpMcpServer with only host and port arguments and pass no middleware, leaving both services unauthenticated. The commands server exposes a run_command tool that passes caller-supplied strings directly to child_process.exec via promisify, enabling arbitrary command execution; the filesystem server similarly exposes unprotected file read and write tools. Any unauthenticated network client able to reach the listening port can exploit these tools. The vulnerability was partially mitigated in commit c2ad42e3eb9b27830db41a3e6f51ca7179d9b168, which changed the default listen address to 127.0.0.1, but versions prior to that commit remain vulnerable with an unauthenticated network-accessible attack surface.
Affected products
- ByteDance UI-TARS-desktop prior to commit c2ad42e3eb9b27830db41a3e6f51ca7179d9b168
Timeline
- 2026-08-27: disclosed: CVE-2026-81735 published
- 2026-08-27: other: Fix committed as c2ad42e3eb9b27830db41a3e6f51ca7179d9b168 changing default listen address to 127.0.0.1