CVE-2026-105793: Microsoft UFO: Authenticated Android shell command injection in Mobile MCP `press_key`
Microsoft UFO is an open-source framework for intelligent automation across devices and platforms. Prior to 3.0.9, the presskey tool in ufo/client/mcp/httpservers/mobilemcpserver.py accepts a free-form keycode parameter and passes it to adb shell input keyevent. The adb client joins the arguments into a remote command string that the Android shell reparses, allowing an authenticated Mobile MCP caller to execute additional commands as the Android shell user on an authorized connected device. Exploitation requires a valid UFOMCPAPIKEY, adb on the host, and a reachable authorized device, and it does not establish host operating-system execution, Android root execution, or access beyond the Android shell-user privileges. This issue is fixed in version 3.0.9.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Microsoft UFOto a version that resolves this vulnerability.Fixed in 3.0.9
Event History
Frequently Asked Questions
Who is exposed to this issue?
Deployments using Microsoft UFO versions before 3.0.9 are exposed only where Mobile MCP is available, adb is installed on the host, and an authorized Android device is reachable. An attacker must also possess a valid UFO_MCP_API_KEY.
What level of access can exploitation provide?
Successful exploitation allows execution of additional commands as the Android shell user on the authorized connected device. It does not provide host operating-system execution, Android root access, or privileges beyond the Android shell user.
Are unauthenticated attackers able to exploit this remotely?
No. Exploitation requires authentication with a valid UFO_MCP_API_KEY, although no user interaction is required once the attacker can call the affected Mobile MCP functionality.
What is the remediation?
Upgrade Microsoft UFO to version 3.0.9, which fixes the issue. The provided data does not specify an alternative mitigation for environments that cannot yet upgrade.