CVE-2026-81735

The mcp-http-server package in UI-TARS-desktop defaulted its listen address to '::' (all interfaces) and applied authentication middleware only when a caller explicitly supplied it, leaving the Streamable HTTP and SSE MCP transports unauthenticated in the default and common configurations. The @agent-infra/mcp-server-commands and @agent-infra/mcp-server-filesystem entry points call the server with only a host and port and no middleware, so any unauthenticated client that can reach the port can invoke the servers' tools without credentials. Through the commands server's run_command tool, which passes the caller-supplied string to child_process.exec, an attacker gains arbitrary command execution as the user running the server, and the filesystem server allows unauthenticated file reads and writes. Anyone running these MCP servers with the HTTP/SSE transport bound to a network-reachable interface is affected; the fix (a 127.0.0.1 listen default) landed in commit c2ad42e3eb9b27830db41a3e6f51ca7179d9b168 while the package version remained 1.2.4, so the affected boundary is that commit rather than a release number. No public proof-of-concept is known, EPSS is 0.5% (43rd percentile), and the issue is not in CISA KEV, so no exploitation is currently known.

What to do: Update mcp-http-server (and dependents @agent-infra/mcp-server-commands and @agent-infra/mcp-server-filesystem) to a build that includes commit c2ad42e3eb9b27830db41a3e6f51ca7179d9b168 or a release containing it, since the 1.2.4 version number alone does not indicate the fix. Until patched, do not expose the MCP HTTP/SSE port to untrusted networks: pass an explicit 127.0.0.1 host, supply authentication middleware to startSseAndStreamableHttpMcpServer, and firewall the port. Check listening sockets on hosts running these servers for bindings on '::' or 0.0.0.0 to identify exposed instances.