CVE-2026-81735: UI-TARS-desktop @agent-infra MCP Servers Bind Every Interface Without Authentication, Exposing Arbitrary Command Execution
startServer.ts in the mcp-http-server package of UI-TARS-desktop defaulted its listen address to '::' when no host was given, so startSseAndStreamableHttpMcpServer bound the Streamable HTTP and SSE MCP transports to every interface, and its authentication middleware was optional: middlewares are applied only when a caller supplies them. The @agent-infra/mcp-server-commands and @agent-infra/mcp-server-filesystem entry points call startSseAndStreamableHttpMcpServer with a host and port alone and pass no middleware, so neither server required a credential. The commands server exposes a runcommand tool that hands its caller-supplied command string to promisify(childprocess.exec), so any unauthenticated client able to reach the port could run arbitrary commands as the user running the server, and the filesystem server exposed its file read and write tools on the same terms. The listen default became 127.0.0.1 in commit c2ad42e3eb9b27830db41a3e6f51ca7179d9b168; the package version stayed at 1.2.4 across that change, so the boundary is the commit rather than a release.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to remote exploitation?
Deployments running the affected commands or filesystem MCP server entry points are exposed when an attacker can reach the server port. Before the fix commit, omitting an explicit host caused the server to bind to all interfaces, rather than only localhost.
Does exploitation require credentials or user interaction?
No. The affected entry points supplied no authentication middleware, so a client that can reach the port could invoke the exposed tools without credentials or user interaction.
What access can an attacker obtain through the exposed services?
The commands server allows arbitrary commands to be executed as the operating-system user running the server. The filesystem server exposes file read and write tools without authentication under the same conditions.
How can I determine whether my code contains the fix?
Verify that the installed source includes commit c2ad42e3eb9b27830db41a3e6f51ca7179d9b168, which changes the default listen address to 127.0.0.1. Do not rely on package version 1.2.4 alone, because that version remained unchanged across the fix.
What can be done if the fix cannot be applied immediately?
Ensure the MCP server ports are not reachable by untrusted clients, since reachability is sufficient for unauthenticated exploitation. Configure a localhost-only listen address where possible and restrict network access to the ports.