Critical Vulnerability in mcp-http-server: What You Need to Know
- Severity
- CRITICAL
- CVSS
- 10
- Affected component
- mcp-http-server (npm)
- Affected versions
- >= @agent-tars@0.3.0-beta.8, <= @agent-tars@0.3.0-beta.8 or >= @agent-tars@0.3.0-beta.7, <= @agent-tars@0.3.0-beta.7 or >= @agent-tars@0.3.0-beta.6, <= @agent-tars@0.3.0-beta.6 or >= @agent-tars@0.3.0-beta.3, <= @agent-tars@0.3.0-beta.3 or >= v0.2.4, <= v0.2.4 or >= v0.2.3, <= v0.2.3 or >= v0.2.2, <= v0.2.2 or >= archived/agent-tars-desktop, <= archived/agent-tars-desktop or >= Agent-TARS-v1.0.0-alpha.10, <= Agent-TARS-v1.0.0-alpha.10 or >= v0.2.1, <= v0.2.1 or >= v0.1.3, <= v0.1.3 or >= v0.2.0, <= v0.2.0 or >= Agent-TARS-v1.0.0-alpha.9, <= Agent-TARS-v1.0.0-alpha.9 or >= v0.1.2, <= v0.1.2 or >= @agent-infra/mcp-shared@1.0.1-beta.10, <= @agent-infra/mcp-shared@1.0.1-beta.10 or >= @agent-infra/mcp-server-filesystem@1.0.1-beta.10, <= @agent-infra/mcp-server-filesystem@1.0.1-beta.10 or >= @agent-infra/mcp-server-commands@1.0.1-beta.10, <= @agent-infra/mcp-server-commands@1.0.1-beta.10 or >= @agent-infra/mcp-server-browser@1.0.1-beta.10, <= @agent-infra/mcp-server-browser@1.0.1-beta.10 or >= @agent-infra/mcp-client@1.0.1-beta.10, <= @agent-infra/mcp-client@1.0.1-beta.10 or >= v0.1.1, <= v0.1.1 or >= v0.1.0, <= v0.1.0 or >= v, <= v or >= v0.0.9, <= v0.0.9 or >= Agent-TARS-v1.0.0-alpha.8, <= Agent-TARS-v1.0.0-alpha.8 or >= v0.0.8, <= v0.0.8 or >= Agent-TARS-v1.0.0-alpha.7, <= Agent-TARS-v1.0.0-alpha.7 or >= Agent-TARS-v1.0.0-alpha.6, <= Agent-TARS-v1.0.0-alpha.6 or >= Agent-TARS-v1.0.0-alpha.5, <= Agent-TARS-v1.0.0-alpha.5 or >= Agent-TARS-v1.0.0-alpha.4, <= Agent-TARS-v1.0.0-alpha.4 or >= Agent-TARS-v1.0.0-alpha.3, <= Agent-TARS-v1.0.0-alpha.3 or >= Agent-TARS-v1.0.0-alpha.2, <= Agent-TARS-v1.0.0-alpha.2 or >= Agent-TARS-v1.0.0-alpha.1, <= Agent-TARS-v1.0.0-alpha.1 or >= v0.0.7, <= v0.0.7 or >= v0.0.6, <= v0.0.6 or >= v0.0.5, <= v0.0.5 or >= v0.0.4, <= v0.0.4 or >= v0.0.4-beta.1, <= v0.0.4-beta.1 or >= @ui-tars/utio@1.0.0, <= @ui-tars/utio@1.0.0 or >= @ui-tars/shared@1.1.0, <= @ui-tars/shared@1.1.0 or >= @ui-tars/action-parser@1.1.0, <= @ui-tars/action-parser@1.1.0 or >= v0.0.3, <= v0.0.3 or >= @ui-tars/shared@1.0.1, <= @ui-tars/shared@1.0.1 or >= @ui-tars/action-parser@1.0.1, <= @ui-tars/action-parser@1.0.1 or >= v0.0.2, <= v0.0.2 or >= @ui-tars/shared@1.0.0, <= @ui-tars/shared@1.0.0 or >= @ui-tars/action-parser@1.0.0, <= @ui-tars/action-parser@1.0.0
- Patched version
- Not yet available
An early warning has been issued for a critical vulnerability in the mcp-http-server package, which could allow unauthenticated clients to execute arbitrary commands on the server.
What happened
The vulnerability, tracked as CVE-2026-81735, reportedly affects the mcp-http-server package in UI-TARS-desktop. It appears to expose HTTP and SSE MCP transports to all interfaces due to a default listen address. This exposure allows unauthenticated clients to run arbitrary commands on the server. The vulnerability was present in versions up to and including commit c2ad42e3eb9b27830db41a3e6f51ca7179d9b168.
The affected versions span a wide range, including but not limited to @agent-tars@0.3.0-beta.8, @agent-tars@0.3.0-beta.7, @agent-tars@0.3.0-beta.6, @agent-tars@0.3.0-beta.3, v0.2.4, v0.2.3, v0.2.2, archived/agent-tars-desktop, Agent-TARS-v1.0.0-alpha.10, v0.2.1, v0.1.3, v0.2.0, Agent-TARS-v1.0.0-alpha.9, v0.1.2, @agent-infra/mcp-shared@1.0.1-beta.10, @agent-infra/mcp-server-filesystem@1.0.1-beta.10, @agent-infra/mcp-server-commands@1.0.1-beta.10, @agent-infra/mcp-server-browser@1.0.1-beta.10, @agent-infra/mcp-client@1.0.1-beta.10, v0.1.1, v0.1.0, v0.0.9, Agent-TARS-v1.0.0-alpha.8, v0.0.8, Agent-TARS-v1.0.0-alpha.7, Agent-TARS-v1.0.0-alpha.6, Agent-TARS-v1.0.0-alpha.5, Agent-TARS-v1.0.0-alpha.4, Agent-TARS-v1.0.0-alpha.3, Agent-TARS-v1.0.0-alpha.2, Agent-TARS-v1.0.0-alpha.1, v0.0.7, v0.0.6, v0.0.5, v0.0.4, v0.0.4-beta.1, @ui-tars/utio@1.0.0, @ui-tars/shared@1.1.0, @ui-tars/action-parser@1.1.0, v0.0.3, @ui-tars/shared@1.0.1, @ui-tars/action-parser@1.0.1, v0.0.2, @ui-tars/shared@1.0.0, @ui-tars/action-parser@1.0.0.
What to do about it
- Upgrade to a version of mcp-http-server after commit c2ad42e3eb9b27830db41a3e6f51ca7179d9b168.
- Ensure proper authentication middleware is applied to secure the server.
- Review your current deployment configurations to confirm that the server is not exposed to unauthenticated clients.
- Monitor the primary sources for updates on the vulnerability and any official fixes that may be released.
How 0Day would have caught this
mcp-http-server is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.
Frequently asked questions
Am I affected?
You may be affected if you are using any of the versions of mcp-http-server listed in the affected components section.
What should I do right now?
Immediately upgrade to a version of mcp-http-server after commit c2ad42e3eb9b27830db41a3e6f51ca7179d9b168 and ensure proper authentication middleware is in place.
Is there an official fix available?
No official fix has been published yet. Monitor the primary sources for updates.