External risk intelligence

UI-TARS Desktop mcp-http-server Unauthenticated Command Execution.

CVE advisorySeverity: CRITICAL (CVSS 10.0)

CVE-2026-81735

The vulnerability allows unauthenticated access by binding services to all interfaces. While this creates risk in network-accessible environments, the component is a developer-centric desktop tool rather than a standard public-facing service, making broad internet exposure less common in typical deployments.

Missing Authentication

Halo Surface Signal: 3 out of 5 — possibly public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability has been identified in the UI-TARS-desktop application, specifically within its mcp-http-server package. This issue, if exploited, could allow unauthenticated access to run arbitrary commands on the server. The primary concern is confirming if this specific technology is in use and if it is exposed in a way that could be targeted.

Unauthenticated access to run commands remotely.
Developers use this tool; check if it's deployed.
Confirm if the vulnerable component is exposed.

Attack Path

How an attacker could exploit the issue

Attackers can exploit this vulnerability by reaching a specific port exposed by the UI-TARS-desktop application. This component binds network services to all available network interfaces by default and has optional authentication that is not always applied. Once connected, an attacker can leverage exposed command execution and file system tools to run arbitrary commands or manipulate files on the affected system.

Accessible without authentication.
Triggered by running arbitrary commands.
Risk of arbitrary code execution.

Live Threat

Current exploitation, exposure, and threat context

When supported by the advisory, unauthenticated clients could execute arbitrary commands as the server's user. This could also expose file read and write operations.

Arbitrary command execution by attackers.
Unauthenticated access to server functionality.
Compromise of the server's operating environment.

Operational Fix

Recommended remediation, mitigation, and detection steps

The UI-TARS-desktop package's mcp-http-server component, specifically the `startServer.ts` file, presents a critical risk due to its default behavior of binding to all network interfaces without requiring authentication. This allows unauthenticated clients to execute arbitrary commands or access file system tools on the host system. Identifying all instances of this software, determining their network reachability, and confirming their business criticality are the immediate first steps.

Ownership: Platform or infrastructure teams.
Verification: Confirm network exposure and business criticality.
Action: Plan remediation or implement compensating controls.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the UI-TARS-desktop mcp-http-server package used for?

This software provides infrastructure for Model Context Protocol (MCP) servers, which allow AI agents to interact with desktop environments. It facilitates communication between agents and local system resources, such as executing commands or accessing files. The affected components, specifically those used for filesystem and command-line interactions, are intended to help agents complete tasks on a developer's local machine.

How does CWE-306 apply to CVE-2026-81735?

CWE-306 refers to a Missing Authentication for Critical Function vulnerability. In this case, the server components fail to verify the identity of the person or program connecting to them. Because the authentication middleware is optional and not implemented by default in specific entry points, the server treats every incoming network connection as trusted, allowing anyone who can reach the service to use its powerful tools.

Do I need to worry if the server is not reachable from the network?

The trigger requires an attacker to reach the service over the network. If the server is bound to localhost (127.0.0.1) and is not reachable from outside the host machine, the risk of remote exploitation is significantly reduced. The vulnerability is triggered by sending unauthorized requests to the open port, so isolating the service or ensuring it cannot accept external connections prevents the issue from being used to run arbitrary commands.

How does Halo Surface Signal categorize this risk?

Halo Surface Signal assigns a 'Possible' label to this CVE because, while the vulnerability is technically critical, it exists within a developer-centric desktop tool rather than a standard internet-facing web service. This means that while internal exposure is common during development, broad public internet exposure is less likely, requiring teams to focus on where these developer tools are running within their specific network environments.

When should I take action for this CVE?

You should prioritize auditing your environment to locate any instances of UI-TARS-desktop that might be running. Because the fix depends on a specific code commit rather than a version number, verify if your installation was built before or after that change. Your immediate step is to restrict network access to these services or move them to bind only to local interfaces, ensuring that only trusted users can interact with the server's tools.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.