CVE-2026-108721: Open Computer Use through 1.0.0 Denylist Bypass via Case-Variant Bundle ID

Q: Who is exposed to this issue?

macOS users running Open Computer Use through 1.0.0 are exposed when the tool can receive local MCP calls and an unlocked password manager is present. Prompt-injected model turns are specifically identified as a potential attacker path.

Q: What does an attacker need to exploit it?

The attacker needs to cause a local MCP caller to submit a case-variant password-manager bundle identifier, such as com.1Password.1Password, to the get_app_state or action tools. Exploitation also depends on access to an unlocked password-manager interface.

Q: What can an attacker do after bypassing the denylist?

They can use the affected tools to read accessibility trees, capture screenshots, and drive the unlocked password-manager interface. This can expose confidential information and allow limited integrity-impacting actions.

Q: How can I tell whether my deployment is affected?

The affected range is Open Computer Use through version 1.0.0 on macOS. A deployment is vulnerable if its denylist accepts case-variant bundle identifiers for password-manager applications rather than handling bundle IDs case-insensitively.

Published Oct 11, 2026

Updated

Open Computer Use through 1.0.0 on macOS contains an improper case sensitivity handling vulnerability that allows local MCP callers to bypass the password-manager denylist using case-variant bundle identifiers. Attackers, including prompt-injected model turns, can pass identifiers like com.1Password.1Password to getappstate and action tools to read accessibility trees, capture screenshots, and drive unlocked password manager interfaces.

Affected Software

1 affected component

Open Computer Use<=1.0.0

Event History

Oct 11, 2026

CVE Published

via MITRE·12:19 PM

Data Sourced

via MITRE·12:19 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·01:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who is exposed to this issue?

macOS users running Open Computer Use through 1.0.0 are exposed when the tool can receive local MCP calls and an unlocked password manager is present. Prompt-injected model turns are specifically identified as a potential attacker path.

What does an attacker need to exploit it?

The attacker needs to cause a local MCP caller to submit a case-variant password-manager bundle identifier, such as com.1Password.1Password, to the get_app_state or action tools. Exploitation also depends on access to an unlocked password-manager interface.

What can an attacker do after bypassing the denylist?

They can use the affected tools to read accessibility trees, capture screenshots, and drive the unlocked password-manager interface. This can expose confidential information and allow limited integrity-impacting actions.

How can I tell whether my deployment is affected?

The affected range is Open Computer Use through version 1.0.0 on macOS. A deployment is vulnerable if its denylist accepts case-variant bundle identifiers for password-manager applications rather than handling bundle IDs case-insensitively.

CVE-2026-108721: Open Computer Use through 1.0.0 Denylist Bypass via Case-Variant Bundle ID

Affected Software

Event History

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit it?

What can an attacker do after bypassing the denylist?

How can I tell whether my deployment is affected?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit it?

What can an attacker do after bypassing the denylist?

How can I tell whether my deployment is affected?