CVE-2026-73296: Microsoft UFO Auth Bypass Vulnerability

CVE-2026-73296 Overview

CVE-2026-73296 is a missing authentication vulnerability [CWE-306] in Microsoft's UFO open-source framework for intelligent automation across devices and platforms. Versions prior to 3.0.8 expose Streamable HTTP Model Context Protocol (MCP) services on TCP ports 8020 and 8021 without any authentication. The affected functions create_mobile_data_collection_server and create_mobile_action_server in ufo/client/mcp/http_servers/mobile_mcp_server.py allow an unauthenticated remote attacker to invoke device control primitives against an ADB-connected Android device. Microsoft resolved the issue in UFO version 3.0.8.

Critical Impact
An unauthenticated network attacker can capture screenshots, read the UI tree, tap, swipe, type text, launch apps, press keys, and click controls on a connected Android device, disclosing screen contents and modifying device state.

Affected Products

Microsoft UFO framework versions prior to 3.0.8
Mobile MCP server component (ufo/client/mcp/http_servers/mobile_mcp_server.py)
Deployments exposing TCP ports 8020 and 8021 with ADB-connected Android devices

Discovery Timeline

2026-08-12 - CVE-2026-73296 published to NVD
2026-08-12 - Last updated in NVD database

Technical Details for CVE-2026-73296

Vulnerability Analysis

The UFO framework spins up two FastMCP-based HTTP servers to broker mobile automation traffic between UFO agents and an ADB-connected Android device. The data collection server on TCP 8020 and the action server on TCP 8021 both bind Streamable HTTP transports without a token verifier or any other authentication layer. Any client that can reach those ports can issue MCP tool calls directly.

The exposed tools include capture_screenshot, get_ui_tree, tap, swipe, type_text, launch_app, press_key, and click_control. This surface permits full observation of the device screen and complete input synthesis, enabling attackers to read credentials, exfiltrate application data, launch arbitrary installed apps, and interact with any UI element on the connected handset.

Root Cause

The MCP server constructors omitted an authentication provider when instantiating the FastMCP transports. The framework accepted MCP tool invocations from any network peer, treating remote callers as trusted local automation clients. The bug maps to [CWE-306: Missing Authentication for Critical Function].

Attack Vector

Exploitation requires only network reachability to ports 8020 or 8021 on the host running UFO. No credentials, user interaction, or prior foothold are required. Once connected, the attacker uses the standard MCP JSON-RPC tool-call schema to invoke device control functions, which the server forwards to the ADB-connected Android device.

python

# Patch excerpt: ufo/client/mcp/http_servers/mobile_mcp_server.py
 import argparse
 import asyncio
 import base64
+import hmac
 import os
 import subprocess
 import tempfile
 import xml.etree.ElementTree as ET
 from typing import Annotated, Any, Dict, List, Optional
 from fastmcp import FastMCP
+from fastmcp.server.auth import AccessToken, TokenVerifier
 from pydantic import Field
 from ufo.agents.processors.schemas.target import TargetInfo, TargetKind


+MCP_API_KEY_ENV_VAR = "UFO_MCP_API_KEY"
+
+
+class APIKeyTokenVerifier(TokenVerifier):
+    """Validate a single configured Mobile MCP bearer credential."""
+
+    def __init__(self, api_key: str) -> None:
+        super().__init__()
+        self._api_key = api_key
+
+    async def verify_token(self, token: str) -> Optional[AccessToken]:
+        if not hmac.compare_digest(token, self._api_key):
+            return None
+
+        return AccessToken(token=token, client_id="ufo-mobile-client", scopes=[])

Source: Microsoft UFO commit e562d10. The patch introduces APIKeyTokenVerifier, a bearer-token verifier that uses hmac.compare_digest against an API key sourced from the UFO_MCP_API_KEY environment variable.

Detection Methods for CVE-2026-73296

Indicators of Compromise

Inbound TCP connections to ports 8020 or 8021 from hosts outside the automation environment.
Unexpected MCP JSON-RPC tool invocations such as capture_screenshot, get_ui_tree, tap, swipe, type_text, launch_app, press_key, or click_control in UFO server logs.
ADB shell activity on the connected Android device that does not correlate with a scheduled UFO automation job.

Detection Strategies

Inspect UFO process logs for MCP tool calls arriving without an Authorization: Bearer header on versions prior to 3.0.8.
Alert on any listener bound to 0.0.0.0:8020 or 0.0.0.0:8021 discovered during host inventory scans.
Correlate new Android app launches or input events with authenticated UFO automation runs to identify anomalous device control.

Monitoring Recommendations

Enable verbose FastMCP request logging and forward it to a centralized log store for retrospective search.
Monitor egress from the UFO host and the connected Android device for atypical data volumes that may indicate screenshot exfiltration.
Track process creations of adb on the UFO host and compare against expected automation windows.

How to Mitigate CVE-2026-73296

Immediate Actions Required

Upgrade Microsoft UFO to version 3.0.8 or later, which introduces bearer-token authentication for the Mobile MCP servers.
Set the UFO_MCP_API_KEY environment variable to a high-entropy secret before starting the servers.
Restrict TCP ports 8020 and 8021 to loopback or a dedicated management network via host firewall rules.
Disconnect ADB from production Android devices until the upgrade and network controls are in place.

Patch Information

Microsoft released the fix in UFO v3.0.8. The remediation is documented in GitHub Security Advisory GHSA-24fq-m9rr-g3mm and implemented in commit e562d10, which adds APIKeyTokenVerifier and requires an API key on both MCP endpoints.

Workarounds

Bind the Mobile MCP servers to 127.0.0.1 only and tunnel access through SSH or a mutually authenticated VPN.
Place the UFO host behind a reverse proxy that enforces client certificate authentication for ports 8020 and 8021.
Disable the mobile MCP components entirely if Android automation is not required for the deployment.

bash

# Configuration example: enforce API-key authentication on UFO 3.0.8+
export UFO_MCP_API_KEY="$(openssl rand -hex 32)"

# Restrict Mobile MCP ports to loopback via iptables
iptables -A INPUT -p tcp --dport 8020 ! -s 127.0.0.1 -j DROP
iptables -A INPUT -p tcp --dport 8021 ! -s 127.0.0.1 -j DROP

# Start UFO with the API key active in the environment
python -m ufo.client.mcp.http_servers.mobile_mcp_server