CVE-2026-62316High· 8.8▾ MidnightPoC availableMicrosoft UFO open-source framework for intelligent automation across devices and platforms. Prior to 3.0.8, ufo/client/mcp/http_servers/linux_mcp_server.py binds a FastMCP streamable HTTP server to localhost:8010 but does not validate t…
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 48.4 · likelihood 0.1 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Sep 9.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.3%
0.3% → 0.5%
Last analysed / modified upstream
Microsoft UFO open-source framework for intelligent automation across devices and platforms. Prior to 3.0.8, ufo/client/mcp/http_servers/linux_mcp_server.py binds a FastMCP streamable HTTP server to localhost:8010 but does not validate the Host, Origin, or Sec-Fetch-Site headers. An attacker-controlled web page can use DNS rebinding to reach the local /mcp endpoint, enumerate tool schemas through tools/list, and invoke execute_command with a valid UFO_MCP_API_KEY to read files or execute allowed operating system commands as the victim's user. This issue is fixed in version 3.0.8.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2023-35636Medium· 6.5Microsoft Outlook Information Disclosure Vulnerability
CVE-2026-105791High· 7.5Microsoft UFO is an open-source framework for intelligent automation across devices and platforms
CVE-2026-105793Critical· 9.1Microsoft UFO is an open-source framework for intelligent automation across devices and platforms
CVE-2026-105792Medium· 6.5Microsoft UFO is an open-source framework for intelligent automation across devices and platforms
CVE-2026-105790Medium· 6.4Microsoft UFO is an open-source framework for intelligent automation across devices and platforms
CVE-2026-105788High· 8.8Microsoft UFO is an open-source framework for intelligent automation across devices and platforms