ByteDance's UI-TARS Desktop Had A CVSS 10 MCP Flaw. Are You Patched?

August 27, 2026

CVE-2026-81735 exposed unauthenticated UI-TARS MCP command and filesystem services. Here is what is fixed, unclear, and worth checking now.

ByteDance's UI-TARS Desktop repository contained a CVSS 10 MCP exposure that could let an unauthenticated network client run commands and read or write files as the server process. The default listener was changed to loopback on July 1, but the August 27 advisory lists no affected or patched release versions. Users should verify the exact code they run, not assume a familiar version number proves the fix is present.

This is a serious source-code vulnerability with a merged fix. It is not proof that every UI-TARS installation exposed a port, that every desktop release included the affected servers, or that anyone exploited the flaw in the wild.

What Is Confirmed

GitHub published CVE-2026-81735 on August 27, 2026. The record is sourced from the National Vulnerability Database, is currently marked unreviewed by GitHub, and carries a CVSS 4.0 score of 10.0.

The affected code sits in ByteDance's public UI-TARS Desktop repository, which had about 38,700 GitHub stars when this article was researched. The project describes UI-TARS Desktop as a native GUI agent for local computers and documents screenshot recognition, mouse and keyboard control, local and remote computer operators, browser operators, shell-style tools, filesystem tools, and Model Context Protocol integration.

The advisory identifies a dangerous combination inside the repository's MCP infrastructure:

1. The shared HTTP/SSE server defaulted its listening host to ::, which can bind to every network interface rather than only the local machine.
2. Authentication middleware was optional.
3. The command and filesystem MCP entry points called the shared server without supplying authentication middleware.
4. The command server passed a caller-controlled command string to Node.js child_process.exec.
5. The filesystem server exposed file-reading and file-writing tools on the same unauthenticated terms.

According to the advisory, an unauthenticated client that could reach one of those running MCP servers could execute commands or use exposed filesystem tools with the permissions of the account running the server.

The network condition matters. Vulnerable code sitting on disk is not the same as a reachable service. The reported attack path requires the affected server to be running and reachable from the attacker's network position.

What ByteDance Changed

ByteDance merged pull request 1918 on July 1. The corresponding fix commit changed one security-critical default:

The commit also updated tests and documentation to use 127.0.0.1. Ten repository checks passed before the change was merged.

Binding to loopback is an important mitigation because a listener on 127.0.0.1 is not ordinarily reachable from another device on the LAN or internet. It does not convert an unauthenticated command server into an authenticated one. Other processes running on the same computer may still be able to reach a loopback service, and an operator can still deliberately override the host and expose it.

What Is Still Unclear

Which Installable Releases Are Affected

The public advisory lists affected versions and patched versions as unknown. That is not a cosmetic omission.

The vulnerable and fixed revisions both report version 1.2.4 for the repository's internal mcp-http-server package. The command and filesystem package versions also did not change in the fix commit. A version string alone therefore cannot distinguish the code before the July 1 change from the code after it.

The repository's public release page also does not provide a new desktop release that maps cleanly to the July 1 security change. Users should not infer a safe version boundary that the advisory and repository do not document.

Whether The Packaged Desktop App Starts These Servers By Default

The advisory describes the MCP command and filesystem server entry points in the repository. It does not establish that every UI-TARS Desktop installer, every Agent TARS configuration, or every ordinary desktop session automatically starts both services.

That distinction changes exposure:

• code present but never started is not a listening service;
• a listener bound only to loopback is narrower than one bound to every interface;
• a listener behind a host firewall is different from one reachable from the LAN or internet; and
• a separately configured authentication layer can change who is able to call the tools.

Users need to inspect their actual process and listener state rather than reasoning from the project name alone.

Whether Anyone Exploited It

No source reviewed for this article reports exploitation in the wild, a confirmed breach, affected-user counts, stolen files, or commands executed on a victim's computer.

That is good news, but it is not proof that exploitation never occurred. The defensible statement is narrower: the vulnerable path and fix are documented, while real-world exploitation remains unconfirmed.

Whether Loopback Is The Complete Fix

The July 1 commit changes the default bind address. It does not add mandatory authentication to the command or filesystem MCP servers.

Loopback substantially reduces remote reachability under normal network conditions. It does not create caller identity, per-tool authorization, approval prompts, or an audit policy. If an operator exposes the server with 0.0.0.0, ::, a container port mapping, a tunnel, a reverse proxy, or another forwarding mechanism, the authentication question returns immediately.

Why A Fully Local Agent Can Still Have A Network Privacy Failure

The UI-TARS repository describes its desktop agent as private and secure with fully local processing. CVE-2026-81735 does not prove that model prompts were sent to ByteDance or another provider. It shows why local processing and local service exposure are separate questions.

A local AI setup has several independent boundaries:

A model can run entirely on hardware you control while an unauthenticated tool server exposes that hardware to other devices. Conversely, a hosted model may have strong service authentication but still process active prompts outside your device. Neither word—local nor hosted—answers every privacy and security question.

This is the same distinction behind the broader question of whether using Ollama means AI is always local and why users should check the complete data path before trusting an AI privacy claim.

How To Check A UI-TARS Or Agent TARS System

Do not start by probing a service over the network. Start with the machine you own or administer and inspect its local state.

1. Identify The Exact Code Or Build

Record how the software was obtained:

• a desktop installer;
• a Git checkout;
• an npm-installed CLI or package;
• a container image; or
• a custom build embedded in another product.

For a source checkout or build, verify that it contains the July 1 fix commit c2ad42e or a later revision with the same host-default change. Do not rely only on the unchanged internal package version.

For a packaged product, look for vendor release notes or a security notice that explicitly maps that package to the fix. If no mapping exists, ask the maintainer for one.

2. Check Whether An MCP Server Is Listening

On Windows, an administrator can inspect wildcard TCP listeners with PowerShell:

Get-NetTCPConnection -State Listen |
  Where-Object LocalAddress -in @('0.0.0.0', '::') |
  Sort-Object LocalPort

On Linux, a typical check is:

ss -lntp

On macOS, a typical check is:

lsof -nP -iTCP -sTCP:LISTEN

A wildcard listener is not automatically UI-TARS. Map the process ID and executable path before drawing a conclusion. If the affected Node.js process owns a listener on 0.0.0.0 or ::, treat that as a meaningful exposure until the configuration is understood.

3. Check Every Reachability Layer

Review more than the program's own host setting:

• operating-system firewall rules;
• router or cloud-security-group rules;
• Docker or Kubernetes port publishing;
• VPN routes;
• reverse proxies;
• development tunnels; and
• remote-access software.

A service bound to all interfaces may still be blocked by a firewall. A loopback service can become reachable if another component deliberately forwards it. The live path is what matters.

4. Stop Or Isolate The Service Until The Boundary Is Known

If you cannot confirm the fix or intended reachability, stop the affected MCP server or isolate it from untrusted networks while you investigate. Prefer loopback binding, explicit caller authentication, least-privilege service accounts, and narrow filesystem roots.

Do not expose command execution or broad filesystem tools merely because the server is described as local.

5. Review Potential Impact Before Rotating Everything

If the service was reachable from an untrusted network, preserve relevant logs and establish the exposure window. Review:

• process creation and shell history;
• file access and modification events;
• outbound network connections;
• account sign-ins;
• repository or package-install changes; and
• credentials accessible to the server account.

Rotate credentials that were actually available to the exposed process or that evidence suggests may have been accessed. A blanket secret rotation without an inventory can miss the important credential while destroying useful incident evidence.

The Broader MCP Pattern

CVE-2026-81735 was not the only MCP-related record published in the same NVD and GitHub intake window. Separate advisories described:

• a Telnyx MCP server that could accept unauthenticated calls and forward its stored credentials;
• ToolUniverse, where an unauthenticated server exposed a Python executor whose deny-list sandbox could be escaped; and
• mcp-router, which defaulted its aggregator to all interfaces and required a token only when the operator supplied the corresponding option.

These are separate products and vulnerabilities. They do not prove a universal MCP protocol flaw. They do reveal a recurring deployment mistake: a tool server with powerful credentials or actions becomes remotely reachable before caller authentication and least privilege are treated as mandatory controls.

The durable lesson is simple: an MCP server is an authority endpoint. Audit it like an API that can use every tool it advertises, not like a harmless local plugin description.

What This Does Not Mean

CVE-2026-81735 does not establish that:

• every UI-TARS Desktop user ran the affected MCP servers;
• every installation exposed a port outside the computer;
• ByteDance remotely accessed users' machines;
• the UI-TARS model itself created the network flaw;
• a prompt injection was required for exploitation;
• a breach occurred; or
• local AI is inherently unsafe.

It establishes a narrower but important point: the repository contained unauthenticated command and filesystem MCP services whose shared server could default to all-interface listening, and the public fixed-release boundary remains incomplete.

Where OpenVeil Fits—and Where It Does Not

OpenVeil is useful for adults who want a narrower privacy-focused AI workspace without operating a local desktop-control agent or exposing MCP command and filesystem services. Normal OpenVeil chat history stays in the browser, and OpenVeil does not maintain a normal server-side chat-history record for private chat sessions.

That does not make OpenVeil fully offline or immune to unrelated security failures. Active prompts, uploads, searches, media requests, and selected local history still have to be processed by OpenVeil and necessary providers. OpenVeil does not patch UI-TARS, inspect your computer's listeners, authenticate a third-party MCP server, block network exploitation, or protect a computer that is already compromised.

The choice is about authority and operational burden. If you need a local agent to control a desktop, run shell commands, or manipulate files, that power may justify the maintenance work—but you must secure the runtime. If you mainly need chat, files, search, voice, and media tools without desktop-level control, a narrower hosted workspace can reduce the number of local services and privileges you have to manage.

You can try OpenVeil's privacy-focused AI workspace with a bounded ten-action preview and no card. Review what browser-local chat history means before deciding whether that boundary fits your work.

FAQ

What Is CVE-2026-81735?

CVE-2026-81735 is a CVSS 10 vulnerability record for MCP command and filesystem server code in the ByteDance UI-TARS Desktop repository. The advisory says the services could bind to every interface without authentication, allowing a reachable unauthenticated client to run commands or use filesystem tools as the server process.

Was UI-TARS Desktop Hacked?

No public source reviewed for this article confirms exploitation, a breach, or victim impact. The vulnerability and code fix are documented; real-world abuse remains unconfirmed.

Is UI-TARS Version 1.2.4 Safe?

The version number alone is not enough. The repository's internal mcp-http-server package remained at version 1.2.4 before and after the loopback fix. Verify the source commit or obtain an explicit vendor mapping for the packaged build you use.

Does Binding To 127.0.0.1 Fix The Problem?

It removes the dangerous all-interface default under ordinary conditions and sharply narrows remote reachability. It does not add authentication, authorization, or per-tool approval. Local processes and deliberate forwarding can still reach a loopback service.

Is This A Prompt-Injection Vulnerability?

Not according to the published advisory. The reported path is direct unauthenticated network access to powerful MCP tools. A malicious prompt is not required if an attacker can already call the exposed server.

Does Fully Local AI Guarantee Privacy?

No. Local model processing can keep prompts and files on hardware you control, but privacy also depends on network listeners, authentication, tools, logs, telemetry, browser interfaces, extensions, and fallback services. Audit the entire data and authority path.

Is OpenVeil A Replacement For UI-TARS Desktop?

Not for desktop automation. OpenVeil is a hosted privacy-focused workspace for chat, web search, files, voice, images, video, and personas. It does not control your desktop or provide UI-TARS's local GUI-agent capabilities.

Bottom Line

Treat CVE-2026-81735 as a serious reason to verify—not a reason to invent a breach. ByteDance changed the shared MCP server's default from all interfaces to loopback, but the public advisory does not identify a clean fixed-release version and the relevant internal version stayed unchanged. Check the exact code, inspect live listeners, restrict reachability, require authentication, and investigate proportionally if the service was exposed.

A local AI agent is only as private as every service and tool around it.