All vulnerabilities

CVE-2026-81735

UI-TARS-desktop @agent-infra MCP servers bind every interface without authentication

criticalCVSS 10.0CWE-306

Vendor

ByteDance

Package

UI-TARS-desktop npm

Affected

< commit c2ad42e

Fixed in

commit c2ad42e

Disclosed

2026-08-27

Credit

Avishai Gonen

auth-bypassrcemcp

Published advisory