CVE-2026-62316: Microsoft UFO Framework RCE Vulnerability

CVE-2026-62316 Overview

CVE-2026-62316 is a DNS rebinding vulnerability in the Microsoft UFO open-source framework for intelligent automation across devices and platforms. Versions prior to 3.0.8 expose a FastMCP streamable HTTP server on localhost:8010 through ufo/client/mcp/http_servers/linux_mcp_server.py. The server does not validate the Host, Origin, or Sec-Fetch-Site request headers. An attacker-controlled web page can rebind DNS to reach the local /mcp endpoint, enumerate tools through tools/list, and invoke execute_command with a valid UFO_MCP_API_KEY to read files or run allowed operating system commands as the victim user. Microsoft addressed the issue in UFO version 3.0.8.

Critical Impact
A remote web page can pivot through the victim's browser to execute commands and read files on the local host running Microsoft UFO.

Affected Products

Microsoft UFO framework versions prior to 3.0.8
ufo/client/mcp/http_servers/linux_mcp_server.py FastMCP HTTP server component
Hosts running UFO with the MCP server bound to localhost:8010

Discovery Timeline

2026-08-21 - CVE-2026-62316 published to NVD
2026-08-25 - Last updated in NVD database

Technical Details for CVE-2026-62316

Vulnerability Analysis

The UFO framework runs a Model Context Protocol (MCP) server on the loopback interface to broker tool invocations for local automation agents. Binding to localhost is not sufficient to isolate the server from the network. A browser on the same host can be tricked into issuing same-origin requests to 127.0.0.1:8010 by using DNS rebinding, where an attacker-controlled domain resolves first to a public IP and then to a loopback address.

Without header validation, the server accepts these cross-origin requests, exposing the full MCP tool surface. The most damaging tool, execute_command, runs allowed shell commands on the underlying operating system. Successful exploitation depends on the attacker obtaining or coercing use of the UFO_MCP_API_KEY, which may be leaked through prior extension exposure, browser storage, or predictable configuration.

The weakness is classified as [CWE-200] Information Exposure, though the practical impact extends to file disclosure and command execution under the victim account.

Root Cause

The FastMCP HTTP transport in linux_mcp_server.py does not enforce a Host/Origin allowlist and does not check Sec-Fetch-Site. Loopback binding is treated as a trust boundary, which DNS rebinding invalidates.

Attack Vector

The victim visits an attacker-controlled page. The attacker's domain rebinds to 127.0.0.1, and browser fetch() calls target /mcp. The attacker enumerates tools via tools/list, then invokes execute_command supplying a captured UFO_MCP_API_KEY to read files or run permitted commands.

python

 from typing import Annotated, Any, Dict, FrozenSet, List, Optional
 from fastmcp import FastMCP
 from pydantic import Field
+from starlette.middleware import Middleware
+from starlette.middleware.base import BaseHTTPMiddleware
+from starlette.requests import Request
+from starlette.responses import JSONResponse

 logger = logging.getLogger(__name__)

+# ---------------------------------------------------------------------------
+# Security: transport-level DNS-rebinding defense (CWE-346)
+#
+# The server binds to localhost, but localhost binding alone does NOT protect
+# against DNS-rebinding: a browser page on an attacker-controlled domain can
+# rebind its DNS record to 127.0.0.1 and issue same-origin ``fetch()`` calls
+# to this server. Such requests carry a non-local ``Host`` header (and usually
+# an ``Origin``/``Sec-Fetch-Site`` header). We reject anything whose Host or
+# Origin is not local, before the request ever reaches a tool.
+# ---------------------------------------------------------------------------
+ALLOWED_LOCAL_HOSTS: FrozenSet[str] = frozenset({"localhost", "127.0.0.1", "::1"})
+
+
+def _extract_hostname(host_header: str) -> str:
+    """Return the bare hostname from a Host/Origin value, stripping any port."""
+    host = host_header.strip()

Source: GitHub Commit 3851c5d — the patch introduces Starlette middleware that enforces a local-host allowlist on the Host and Origin headers.

Detection Methods for CVE-2026-62316

Indicators of Compromise

Unexpected inbound HTTP requests to 127.0.0.1:8010/mcp with a non-local Host or Origin header.
Browser process spawning fetch() traffic targeting the loopback UFO MCP endpoint.
MCP audit entries showing tools/list enumeration followed by execute_command invocations from unattended sessions.
Child processes created by the UFO Python interpreter that do not match expected automation workflows.

Detection Strategies

Instrument the MCP server or a local reverse proxy to log Host, Origin, and Sec-Fetch-Site headers, and alert on non-loopback values.
Correlate browser-initiated loopback traffic on port 8010 with subsequent shell process creation on the endpoint.
Monitor for UFO_MCP_API_KEY values appearing in browser storage, DOM, or outbound web traffic.

Monitoring Recommendations

Enable command-line auditing on hosts running UFO and baseline processes spawned by the Python runtime hosting linux_mcp_server.py.
Capture DNS resolutions that flip from public IPs to 127.0.0.1 within short time windows, a hallmark of DNS rebinding.
Track file read operations initiated from the UFO service account against sensitive paths outside automation scope.

How to Mitigate CVE-2026-62316

Immediate Actions Required

Upgrade Microsoft UFO to version 3.0.8 or later, which enforces Host and Origin validation.
Rotate any UFO_MCP_API_KEY values that may have been exposed to browsers or local extensions.
Restrict outbound browsing on hosts that run UFO with the MCP server enabled.

Patch Information

Microsoft released the fix in UFO v3.0.8. The patching commit is 3851c5d4e17c2865c56a94a6530692bf6e7a9b02. Full technical details are in the GHSA-vf4c-mf32-gf2h advisory.

Workarounds

Block the UFO MCP port at the host firewall for all sources except loopback with explicit Host: localhost validation via a local proxy.
Disable the FastMCP HTTP transport when interactive automation is not required.
Configure browsers or endpoint controls to prevent resolution of external domains to RFC1918 or loopback addresses (DNS rebinding protection).

bash

# Example: pin UFO to the patched release
pip install --upgrade "ufo-agent>=3.0.8"

# Verify the MCP server is not exposed beyond loopback
ss -ltnp | grep 8010