CVE-2026-62316: Microsoft UFO: DNS Rebinding → Unauthenticated File Read / Command Execution
Microsoft UFO open-source framework for intelligent automation across devices and platforms. Prior to 3.0.8, ufo/client/mcp/httpservers/linuxmcpserver.py binds a FastMCP streamable HTTP server to localhost:8010 but does not validate the Host, Origin, or Sec-Fetch-Site headers. An attacker-controlled web page can use DNS rebinding to reach the local /mcp endpoint, enumerate tool schemas through tools/list, and invoke executecommand with a valid UFOMCPAPIKEY to read files or execute allowed operating system commands as the victim's user. This issue is fixed in version 3.0.8.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Microsoft UFOto a version that resolves this vulnerability.Fixed in 3.0.8
Event History
Frequently Asked Questions
Who is exposed to this issue?
Users running Microsoft UFO versions before 3.0.8 with the Linux MCP HTTP server available on localhost:8010 are exposed. Exploitation occurs in the victim's user context, so accessible files and permitted operating system commands may be affected.
What does an attacker need to exploit it?
An attacker needs a victim to interact with an attacker-controlled web page capable of performing DNS rebinding. The attack also requires a valid UFO_MCP_API_KEY to invoke execute_command; the exposed endpoint can reveal tool schemas through tools/list.
Are default localhost-only deployments protected?
No. The affected server binds to localhost:8010, but it does not validate Host, Origin, or Sec-Fetch-Site headers, allowing an attacker-controlled page to reach the local /mcp endpoint through DNS rebinding.
What is the remediation?
Upgrade Microsoft UFO to version 3.0.8, which fixes the issue.