CVE-2026-62316
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk24th percentile - higher than 24% of all known CVEs
Summary
Microsoft UFO, an open-source framework for intelligent automation, prior to version 3.0.8, contains an MCP server on localhost:8010 that does not validate Host, Origin, or Sec-Fetch-Site headers. An attacker-controlled web page can use DNS rebinding to reach the local /mcp endpoint, enumerate tool schemas, and invoke execute_command with a valid UFO_MCP_API_KEY, allowing reading files or executing allowed OS commands as the victim's user. This issue is fixed in version 3.0.8.
Risk Assessment
An attacker can access local resources and execute system commands on behalf of the user, potentially leading to confidentiality and integrity breaches.
Recommendation
It is recommended to upgrade Microsoft UFO to version 3.0.8 or later and consider additional protections such as header validation at the server level.
Other vulnerabilities in Microsoft UFO
See all- CVE-2026-73297Medium
Microsoft UFO framework before version 3.0.8 does not block NAT64, 6to4, and Teredo prefixes and does not re-check embedded IPv4 addresses, allowing a remote attacker to bypass the SSRF guard and reach cloud metadata, internal services, or localhost.
- CVE-2026-55440Medium
In the Microsoft UFO framework before version 3.0.7, the COMMAND_RESULTS handler calls get_or_create_session without owner_client_id, allowing an authenticated client to create a session with an arbitrary name (e.g., constellation_task_id = f"{task_name}@{task_id}"). This can lead to denial of service for the legitimate owner or memory exhaustion from phantom sessions.
- CVE-2026-73296Critical
Microsoft UFO framework before version 3.0.8 exposes Streamable HTTP MCP services on TCP ports 8020 and 8021 without authentication. This allows an unauthenticated remote attacker to invoke functions such as screenshot capture, taps, swipes, text typing, app launching, and modifying device state on an ADB-connected Android device.
- CVE-2026-54568Medium
In Microsoft UFO framework versions 3.0.0 through 3.0.6, a vulnerability was found due to missing object-level authorization. A client connected as a DEVICE to the WebSocket server could send a DEVICE_INFO_REQUEST with another device's target_id and obtain its system information.
Original NVD description (English source)
Microsoft UFO open-source framework for intelligent automation across devices and platforms. Prior to 3.0.8, ufo/client/mcp/http_servers/linux_mcp_server.py binds a FastMCP streamable HTTP server to localhost:8010 but does not validate the Host, Origin, or Sec-Fetch-Site headers. An attacker-controlled web page can use DNS rebinding to reach the local /mcp endpoint, enumerate tool schemas through tools/list, and invoke execute_command with a valid UFO_MCP_API_KEY to read files or execute allowed operating system commands as the victim's user. This issue is fixed in version 3.0.8.