CVE-2026-105789 in UFO
Summary
by MITRE • 10/06/2026
Microsoft UFO is an open-source framework for intelligent automation across devices and platforms. Prior to 3.0.9, the execute_command tool in ufo/client/mcp/http_servers/linux_mcp_server.py treats sort and uniq as read-only commands while the free-form command parameter can select their file-output forms. An authenticated caller can use sort -o or the optional second uniq operand to create or overwrite files writable by the UFO server process without shell metacharacters, because the allowed binary opens the destination itself and the argument policy does not reject the operation. This can corrupt configuration or other writable data and disrupt the service, but the demonstrated primitive does not directly disclose files or establish arbitrary code execution. This issue is fixed in version 3.0.9.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/06/2026
The vulnerability identified in Microsoft UFO prior to version 3.0.9 represents a significant security flaw within its intelligent automation framework, specifically affecting the execute_command tool located in the linux_mcp_server.py module. As an open-source solution designed for cross-platform device management and automation, UFO relies on strict command execution policies to prevent unauthorized system modifications. However, the implementation of this policy contained a critical logic error regarding how certain standard Unix utilities were classified and processed. The developers had explicitly categorized sort and uniq as read-only commands under the assumption that these tools would only be used for data analysis or display purposes without side effects on the file system. This classification was intended to restrict authenticated users from performing write operations through these specific binaries, thereby maintaining a secure boundary between user-initiated automation tasks and sensitive system configurations.
The technical flaw arises because while sort and uniq are indeed primarily read-oriented utilities, they both possess optional parameters that allow for direct file output manipulation. Specifically, the sort command accepts an -o flag to specify an output file, and uniq can accept a second operand to designate an output destination. The vulnerability exists because the argument validation logic in UFO failed to reject these specific invocation patterns despite the binary being whitelisted as read-only. Consequently, when an authenticated caller provides arguments such as sort -o or utilizes the optional second operand for uniq, the underlying operating system executes the command with full file write privileges granted by the server process context. The vulnerability does not require shell metacharacters like pipes or redirection symbols because the binaries themselves handle the file opening and writing operations internally based on their own argument parsing logic.
This architectural oversight allows an authenticated attacker to create new files or overwrite existing ones that are writable by the UFO server process. In a typical deployment, this could include configuration files, log directories, or other data structures managed by the automation framework. The operational impact of this vulnerability is primarily centered on integrity and availability rather than confidentiality or direct remote code execution. By corrupting critical configuration files, an attacker can disrupt the normal functioning of the UFO service, leading to denial of service conditions for automated workflows dependent on those configurations. Furthermore, overwriting sensitive data could lead to inconsistent states within the automation environment, potentially causing cascading failures in downstream systems that rely on accurate state information from the UFO platform.
From a classification perspective, this vulnerability aligns with CWE-20 Improper Input Validation and CWE-732 Incorrect Permission Assignment for Critical Resource. The failure lies not in a lack of permissions but in the incorrect assignment of trust to specific command invocations based solely on their primary function rather than all possible execution paths. In terms of attack vectors, this scenario is consistent with MITRE ATT&CK techniques related to Command and Scripting Interpreter abuse, specifically where an attacker leverages legitimate system utilities for unintended purposes due to insufficient input sanitization or policy enforcement. The absence of shell metacharacters makes detection more challenging as the activity appears as standard utility execution rather than complex script injection.
The recommended mitigation is straightforward and has already been implemented in subsequent releases. Organizations running Microsoft UFO versions prior to 3.0.9 must upgrade immediately to version 3.0.9 or later, where the argument policy has been corrected to explicitly reject file output arguments for sort and uniq when executed through the execute_command tool. Until the upgrade is performed, administrators should monitor logs for unusual usage of these utilities by the UFO service account and restrict network access to the MCP server interface to trusted internal networks only. Additionally, implementing strict filesystem permissions that limit what files the UFO process can write to can provide a defense-in-depth layer, reducing the impact even if similar vulnerabilities are discovered in future versions.