UI-TARS-desktop MCP Server Unauthenticated RCE via Default Wildcard Bind

Technical Analysis

The vulnerability stems from startServer.ts in mcp-http-server, where startSseAndStreamableHttpMcpServer bound Streamable HTTP and SSE MCP transports to '::' (all interfaces) by default when no host was explicitly configured, and applied authentication middleware only if the caller explicitly supplied it. Downstream consumers @agent-infra/mcp-server-commands and @agent-infra/mcp-server-filesystem called this function with only host and port, omitting middleware entirely, resulting in fully unauthenticated exposure. The commands server's run_command tool passes caller-supplied strings directly to promisify(child_process.exec), enabling trivial unauthenticated remote code execution as the service account user; the filesystem server similarly exposed unauthenticated file read/write primitives. The fix (commit c2ad42e3eb9b27830db41a3e6f51ca7179d9b168) changed the default bind to 127.0.0.1 without a version bump, so organizations must verify against commit hash rather than package version to confirm remediation. This directly and severely impacts AI agent systems: MCP (Model Context Protocol) servers are core infrastructure for agent tool use, and any organization running UI-TARS-desktop agents with these command-execution or filesystem tool servers is exposed to full unauthenticated remote takeover of the host running the agent's tool backend.

Affected Systems

UI-TARS-desktop deployments using mcp-http-server package version 1.2.4 (pre-fix commit) with @agent-infra/mcp-server-commands and @agent-infra/mcp-server-filesystem entry points configured without an explicit host binding or authentication middleware; any instance not updated past commit c2ad42e3eb9b27830db41a3e6f51ca7179d9b168.

Indicators of Compromise

• File: startServer.ts (mcp-http-server package)
• Commit hash: c2ad42e3eb9b27830db41a3e6f51ca7179d9b168
• Exposed tool name: run_command
• Affected packages: @agent-infra/mcp-server-commands, @agent-infra/mcp-server-filesystem (version 1.2.4)
• Default pre-fix bind address: ::
• Post-fix bind address: 127.0.0.1

Remediation Steps

1. 1

   Update to patched commit

   Ensure mcp-http-server and dependent packages (@agent-infra/mcp-server-commands, @agent-infra/mcp-server-filesystem) are updated to include commit c2ad42e3eb9b27830db41a3e6f51ca7179d9b168 or later, verifying by commit hash rather than version number since 1.2.4 spans both vulnerable and fixed states.

2. 2

   Restrict network exposure

   Explicitly bind MCP HTTP/SSE servers to 127.0.0.1 or a trusted internal interface, and use firewall rules to block external access to MCP server ports until the update is confirmed.

3. 3

   Enforce authentication middleware

   Explicitly configure and require authentication middleware for all MCP server instances rather than relying on defaults; audit any custom deployments that invoke startSseAndStreamableHttpMcpServer without middleware.

4. 4

   Audit for exploitation

   Review logs for unexpected connections to MCP server ports, unusual run_command invocations, or unauthorized file read/write activity, and rotate any credentials or secrets accessible to the affected host.

5. 5

   Limit service account privileges

   Run MCP command and filesystem servers under least-privilege service accounts to reduce the impact of any future unauthenticated RCE.