Microsoft UFO EUVD-2026-64136

Exploitation requires the victim to be actively running the UFO framework's Linux MCP server (linux_mcp_server.py) on localhost:8010 at the time of attack - this server is not started by default and must be explicitly launched as part of the UFO MCP workflow. The attacker must additionally possess or obtain a valid UFO_MCP_API_KEY to invoke execute_command; the description states this key is required for file reads and OS command execution, though how an attacker acquires this key in practice is not fully specified in the available data. Active user interaction is required: the victim must visit an attacker-controlled web page in a browser running on the same machine as the UFO server. The DNS rebinding technique requires the attacker to control a domain with configurable low-TTL DNS records. Exploitation is scoped to Linux deployments only, as the vulnerable file is linux_mcp_server.py. The attack does not require any prior authenticated relationship between the attacker and the UFO server, but the UFO_MCP_API_KEY prerequisite is a substantive barrier beyond what the CVSS PR:N designation implies.

The vendor-assigned CVSS 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) captures the network accessibility and full CIA impact but overstates ease of exploitation in two concrete ways: DNS rebinding requires attacker-controlled DNS infrastructure with short TTL records and browser-side timing, and the description explicitly states that invoking execute_command requires a valid UFO_MCP_API_KEY - a prerequisite the PR:N metric does not reflect, creating a discrepancy between the CVSS vector and the described conditions that defenders should verify against their own UFO deployments. UFO is not listed in CISA KEV and no EPSS score was provided in the input data; no public proof-of-concept has been identified at time of analysis. Real-world risk is further bounded by UFO's deployment footprint as a developer and research tool rather than broadly deployed enterprise software. For any developer running the UFO Linux MCP server locally while browsing the web, however, the potential for complete account-level compromise through file exfiltration or shell command execution is serious and warrants immediate patching to v3.0.8.

A developer running the UFO Linux MCP server locally browses to an attacker-controlled page that initially loads from the attacker's domain over the internet. The attacker then changes the domain's DNS record to resolve to 127.0.0.1 with a very short TTL, causing subsequent JavaScript fetch() calls from the still-open page to be routed to localhost:8010 as same-origin requests. The attacker's script enumerates MCP tool schemas via tools/list and, using a previously obtained or guessed UFO_MCP_API_KEY, calls execute_command to exfiltrate SSH private keys or execute arbitrary shell commands as the victim's local user account.