CVE-2026-81735: Missing Authentication for Critical Function in bytedance UI-TARS-desktop

The vulnerability arises because the startSseAndStreamableHttpMcpServer function binds Streamable HTTP and SSE MCP transports to every network interface by default ('::') when no host is specified, and its authentication middleware is optional and not applied if not supplied. The commands server exposes a run_command tool that executes caller-supplied commands via promisify(child_process.exec) without authentication, enabling arbitrary command execution by any unauthenticated client able to reach the port. Similarly, the filesystem server exposes file read and write tools without authentication. The default listen address was changed to 127.0.0.1 in a commit (c2ad42e3eb9b27830db41a3e6f51ca7179d9b168), but the package version remained at 1.2.4, so the fix is tied to the commit rather than a version release.

An unauthenticated remote attacker can execute arbitrary commands on the host system with the privileges of the user running the server and can read and write files via exposed filesystem tools. This leads to full system compromise, data theft, and potential further network pivoting. The vulnerability has a CVSS 4.0 score of 10.0, indicating critical severity with network attack vector, no required privileges or user interaction, and high impact on confidentiality, integrity, and availability.

The vulnerability was mitigated by changing the default listen address from '::' (all interfaces) to '127.0.0.1' (localhost) in commit c2ad42e3eb9b27830db41a3e6f51ca7179d9b168. Users should ensure they are running the code including this commit or have otherwise restricted the server's listening interfaces to trusted hosts only. Since the package version did not change, verification by commit hash or source code inspection is necessary. Applying this fix or restricting network exposure of the affected services is essential to prevent exploitation.