CVE-2026-62316: Microsoft UFO MCP Server DNS Rebinding and SSRF via Missing Host Validation

Executive Summary

CVE-2026-62316 is a CVSS 8.8 high server-side request forgery (SSRF) and DNS rebinding vulnerability in Microsoft UFO, the company's open-source intelligent automation framework for Windows and Linux. The flaw is in the Linux MCP (Model Context Protocol) HTTP server: ufo/client/mcp/http_servers/linux_mcp_server.py starts a FastMCP streamable HTTP server bound to localhost:8010 but performs no validation of the Host, Origin, or Sec-Fetch-Site request headers.

This omission enables classic DNS rebinding attacks and direct SSRF from attacker-controlled web pages or network contexts. The issue is fixed in UFO 3.0.8.

Vulnerability Details

Root Cause

When the UFO Linux MCP server starts, it binds FastMCP in streamable HTTP mode to 127.0.0.1:8010. The intended security model is that the service is only reachable from localhost — but without validating the Host header or checking Origin/Sec-Fetch-Site, the server accepts any HTTP request that arrives on that port, regardless of where the request originated.

This creates two attack surfaces:

1. DNS Rebinding

An attacker hosts a malicious web page that causes the victim's browser to resolve a domain to 127.0.0.1. Once the DNS TTL expires and rebinding occurs, subsequent requests from the page reach the UFO MCP server. Because the server does not validate that the Host header refers to localhost, it processes these requests as legitimate.

2. Direct SSRF via Co-Located Services

In shared or containerized environments, other services running on the same host can make HTTP requests to localhost:8010 and interact with UFO's MCP endpoint without any credential requirement — the missing header checks mean there is no way to distinguish an authorized local client from a malicious co-tenant.

Attack Flow (DNS Rebinding)

1. Attacker registers attacker.example with short TTL DNS record → victim's IP
2. Victim visits attacker.example in browser
3. Attacker changes DNS record to resolve attacker.example → 127.0.0.1
4. Browser's DNS cache expires; attacker.example now resolves to localhost
5. Malicious JavaScript on attacker.example sends requests to http://attacker.example:8010
6. Browser forwards requests to 127.0.0.1:8010 (the UFO MCP server)
7. UFO server accepts requests — no Host header validation rejects attacker.example
8. Attacker executes MCP tool calls through UFO with victim's local privileges

Impact

Successful exploitation allows an attacker to:

• Invoke any MCP tool exposed by the UFO Linux server (automation actions, file access, system interactions)
• Use UFO as an SSRF pivot to reach other localhost services
• Exfiltrate automation context, session state, or files accessible to the UFO process

Affected Versions

Remediation

Upgrade to UFO 3.0.8

pip install --upgrade ufo-agent
# or from source
git pull && pip install -e .

Verify:

import ufo
print(ufo.__version__)  # Should be 3.0.8 or later

Interim Mitigations

If upgrading immediately is not possible:

Option 1: Disable the Linux MCP server

If you do not require the MCP HTTP interface, avoid starting linux_mcp_server.py until patched.

Option 2: Firewall localhost:8010

Restrict access to port 8010 to only the specific process that requires it:

# Block external access while allowing loopback only
iptables -A INPUT -p tcp --dport 8010 ! -s 127.0.0.1 -j DROP

Note: this does not prevent DNS rebinding from a browser, which bypasses the firewall via the victim's own loopback interface.

Option 3: Browser-level DNS rebinding protection

Enable DNS rebinding protection in your browser or local DNS resolver (e.g., configure dnsmasq to refuse rebinding of public domains to 127.0.0.1):

# dnsmasq.conf
stop-dns-rebind
rebind-localhost-ok

Detection

Check for Unexpected Connections to Port 8010

# Monitor connections to the UFO MCP port
ss -tnp | grep :8010
 
# Or with netstat
netstat -tnp 2>/dev/null | grep :8010

Review UFO MCP Access Logs

The FastMCP server logs incoming requests. Look for Host headers that are not localhost or 127.0.0.1:

grep "Host:" /var/log/ufo/mcp.log | grep -v "localhost\|127\.0\.0\.1"

Any entry with an external or unexpected Host value may indicate a DNS rebinding attempt.

Background: MCP Security Considerations

The Model Context Protocol (MCP) is a growing standard for connecting AI agents to tools and resources. As more frameworks expose MCP HTTP servers for local AI agent use, the pattern of binding to localhost without header validation is likely to recur. This vulnerability class — sometimes called localhost CSRF or DNS rebinding against localhost services — is well-documented but frequently overlooked when localhost binding is assumed to be sufficient isolation.

Security teams evaluating MCP-enabled tools should verify that any HTTP-based MCP server:

• Validates the Host header against an explicit allowlist (localhost, 127.0.0.1)
• Checks Origin or Sec-Fetch-Site for cross-origin requests
• Requires a secret token or mutual authentication for sensitive tool invocations
• Is not accessible from co-tenant processes in shared environments

References

• NIST NVD — CVE-2026-62316
• Microsoft UFO GitHub
• GitHub Security Advisory (microsoft/UFO)
• OWASP DNS Rebinding