EUVD-2026-64136Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
DNS rebinding requires attacker-controlled DNS infrastructure and a valid UFO_MCP_API_KEY for command execution, warranting AC:H rather than the vendor-assigned AC:L.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Lifecycle Timeline
4DescriptionCVE.org
Microsoft UFO open-source framework for intelligent automation across devices and platforms. Prior to 3.0.8, ufo/client/mcp/http_servers/linux_mcp_server.py binds a FastMCP streamable HTTP server to localhost:8010 but does not validate the Host, Origin, or Sec-Fetch-Site headers. An attacker-controlled web page can use DNS rebinding to reach the local /mcp endpoint, enumerate tool schemas through tools/list, and invoke execute_command with a valid UFO_MCP_API_KEY to read files or execute allowed operating system commands as the victim's user. This issue is fixed in version 3.0.8.
AnalysisAI
DNS rebinding against Microsoft UFO's Linux MCP server (all versions prior to 3.0.8) enables an attacker-controlled web page to bypass localhost binding protections and reach the local /mcp endpoint via the victim's browser. Because the FastMCP streamable HTTP server bound to localhost:8010 performed no Host, Origin, or Sec-Fetch-Site header validation, a browser performing a DNS rebind could enumerate available tool schemas via tools/list and invoke execute_command with a valid UFO_MCP_API_KEY, resulting in arbitrary file reads or OS command execution as the victim's local user. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the victim to be actively running the UFO framework's Linux MCP server (linux_mcp_server.py) on localhost:8010 at the time of attack - this server is not started by default and must be explicitly launched as part of the UFO MCP workflow. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The vendor-assigned CVSS 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) captures the network accessibility and full CIA impact but overstates ease of exploitation in two concrete ways: DNS rebinding requires attacker-controlled DNS infrastructure with short TTL records and browser-side timing, and the description explicitly states that invoking execute_command requires a valid UFO_MCP_API_KEY - a prerequisite the PR:N metric does not reflect, creating a discrepancy between the CVSS vector and the described conditions that defenders should verify against their own UFO deployments. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A developer running the UFO Linux MCP server locally browses to an attacker-controlled page that initially loads from the attacker's domain over the internet. The attacker then changes the domain's DNS record to resolve to 127.0.0.1 with a very short TTL, causing subsequent JavaScript fetch() calls from the still-open page to be routed to localhost:8010 as same-origin requests. … |
| Remediation | Upgrade Microsoft UFO to version 3.0.8 or later, which is confirmed as the vendor-released patch; the fixing commit is available at https://github.com/microsoft/UFO/commit/3851c5d4e17c2865c56a94a6530692bf6e7a9b02 and the release at https://github.com/microsoft/UFO/releases/tag/v3.0.8. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all systems running Microsoft UFO MCP server versions prior to 3.0.8, including development workstations, build infrastructure, and servers; consult deployment records and package management systems for complete visibility. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Missing authentication in Microsoft UFO's mobile MCP servers lets an unauthenticated remote attacker fully control an AD
Server-side request forgery in Microsoft UFO's URL validation layer allows unauthenticated remote attackers to bypass th
Session-squatting and memory exhaustion in Microsoft UFO's WebSocket server allow any authenticated client to permanentl
Cross-device system_info disclosure in Microsoft UFO's WebSocket server allows any authenticated DEVICE-role client to r
Same weakness CWE-200 – Information Exposure
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today