id: CVE-2026-81735

info:
  name: "UI-TARS-desktop mcp-http-server - Unauthenticated MCP Command Execution Exposure"
  author: vedas-arpsyndicate
  severity: critical
  description: |
    The mcp-http-server package of UI-TARS-desktop defaulted its listen address to '::' and
    applied authentication middleware only when a caller supplied one. The
    @agent-infra/mcp-server-commands and @agent-infra/mcp-server-filesystem entry points start
    the Streamable HTTP / SSE MCP transports with no middleware, so any unauthenticated client
    able to reach the port can complete the MCP handshake and invoke the run_command tool,
    which passes a caller-supplied command to child_process.exec, yielding remote command
    execution. Fixed by defaulting the listen address to 127.0.0.1 in commit c2ad42e3.
  reference:
    - https://www.exploit.observer/?keyword=CVE-2026-81735&match=exact
    - https://subdomain.center/?engine=ammonites&keyword=ui-tars&match=exact
  classification:
    cvss-metrics: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
    cvss-score: 10.0
    cve-id: CVE-2026-81735
    cwe-id: CWE-306
  metadata:
    verified: false
  tags: cve,cve2026,ui-tars,mcp,rce
http:
  - raw:
      - |
        POST /mcp HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/json
        Accept: application/json, text/event-stream

        {"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2025-06-18","capabilities":{},"clientInfo":{"name":"mcp","version":"1.0"}}}

    matchers:
      - type: dsl
        dsl:
          - 'contains(body, "protocolVersion")'
          - 'contains(body, "jsonrpc")'
          - 'status_code == 200'
        condition: and