CVE-2026-81735 bytedance CVE debrief

Who should care

Defenders and security teams using the UI-TARS-desktop package should assess their exposure and take immediate action to verify and mitigate this vulnerability. System administrators, security engineers, and DevOps teams are advised to review the vulnerability details and implement the recommended actions to prevent exploitation.

Why it matters

CVE-2026-81735 is a critical vulnerability in the UI-TARS-desktop package that allows for arbitrary command execution and unauthorized file access due to optional authentication middleware and a default listen address of '::'. Defenders should verify their exposure, implement authentication middleware, restrict the listen address, and monitor the system for suspicious activity.

• Unauthenticated access to the commands server can lead to arbitrary command execution as the user running the server.
• Unauthenticated access to the filesystem server can lead to unauthorized file read and write operations.
• The vulnerability can be exploited by any client able to reach the port, making it a critical concern for systems exposed to untrusted networks.
• Verification of the UI-TARS-desktop package version and implementation of authentication middleware are crucial to prevent exploitation.

Technical summary

The mcp-http-server package in UI-TARS-desktop has a critical vulnerability (CVE-2026-81735) due to a default listen address of '::' which binds the Streamable HTTP and SSE MCP transports to every interface. The authentication middleware is optional, and the @agent-infra/mcp-server-commands and @agent-infra/mcp-server-filesystem entry points call startSseAndStreamableHttpMcpServer with a host and port alone and pass no middleware, making the servers unauthenticated. The commands server exposes a run_command tool that can run arbitrary commands as the user running the server, and the filesystem server exposes its file read and write tools on the same terms.

Defensive priority

High priority should be given to verifying and mitigating this vulnerability, especially for systems and deployments using the affected package.

Recommended defensive actions

• Verify the UI-TARS-desktop package version and check if the system is using a version prior to the fix commit c2ad42e3eb9b27830db41a3e6f51ca7179d9b168.
• Implement authentication middleware for the mcp-http-server component to prevent unauthorized access.
• Restrict the listen address to a specific IP address instead of the default '::'.
• Monitor the system for any suspicious activity and implement additional security measures to prevent exploitation.
• Perform an asset inventory to identify systems using the affected package.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Track exceptions and retest remediated assets to ensure the vulnerability is fully mitigated.

Evidence notes

The vulnerability details are based on the official CVE record and source references provided. However, some information such as the exact scope of affected systems and versions requires further verification from the official sources.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.