A default listen address of :: combined with optional authentication middleware left ByteDance's UI-TARS-desktop MCP command and filesystem servers reachable by any unauthenticated network client, yielding arbitrary command execution as the server user.
What Is It
startServer.ts in the mcp-http-server package of UI-TARS-desktop defaulted its listen address to :: when no host was supplied. As a result, startSseAndStreamableHttpMcpServer bound the Streamable HTTP and SSE MCP transports to every interface. Its authentication middleware was optional; middlewares are applied only when a caller supplies them.
The @agent-infra/mcp-server-commands and @agent-infra/mcp-server-filesystem entry points call startSseAndStreamableHttpMcpServer with only a host and port and pass no middleware, so neither server required a credential. The issue is classified as CWE-306 (Missing Authentication for Critical Function) and carries a CVSS 3.1 base score of 10.0 (CRITICAL, AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H), with an equivalent CVSS 4.0 score of 10.0.
Why It Matters
The commands server exposes a run_command tool that hands its caller-supplied command string to promisify(child_process.exec). Any unauthenticated client able to reach the port could run arbitrary commands as the user running the server. The filesystem server exposed its file read and write tools on the same terms. Attack complexity is low, no privileges or user interaction are required, and the scope is Changed.
What's Vulnerable
- Vendor: bytedance; Product: UI-TARS-desktop
- Affected: all git revisions prior to commit
c2ad42e3eb9b27830db41a3e6f51ca7179d9b168 - Unaffected: commit
c2ad42e3eb9b27830db41a3e6f51ca7179d9b168and later - Affected components:
@agent-infra/mcp-server-commands,@agent-infra/mcp-server-filesystem,mcp-http-server
Patch Status
The listen default became 127.0.0.1 in commit c2ad42e3eb9b27830db41a3e6f51ca7179d9b168. The package version stayed at 1.2.4 across that change, so the remediation boundary is the commit rather than a release; version-based checks will not distinguish a patched install from a vulnerable one. Operators should verify by commit hash. The NVD record was published 2026-08-27 and remains in Received status, so its enrichment data is not yet final.