CVE-2026-108721 in Open Computer Use
Summary
by MITRE • 10/11/2026
Open Computer Use through 1.0.0 on macOS contains an improper case sensitivity handling vulnerability that allows local MCP callers to bypass the password-manager denylist using case-variant bundle identifiers. Attackers, including prompt-injected model turns, can pass identifiers like com.1Password.1Password to get_app_state and action tools to read accessibility trees, capture screenshots, and drive unlocked password manager interfaces.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/11/2026
The vulnerability identified in Open Computer Use version 1.0.0 for macOS represents a critical security flaw rooted in improper case sensitivity handling within the application's access control mechanisms. This specific weakness allows local Model Context Protocol (MCP) callers to circumvent the intended password-manager denylist by utilizing bundle identifiers that differ only in their character casing, such as submitting com.1Password.1Password instead of the expected canonical form. In macOS environments, file system and process identification often rely on case-insensitive matching for convenience, but security controls must explicitly enforce strict equality checks to prevent evasion techniques. By exploiting this discrepancy, an attacker can trick the application into treating a blocked entity as an allowed one, thereby bypassing the protective barriers designed to restrict access to sensitive password management interfaces.
From a technical perspective, the core issue lies in the validation logic used when processing bundle identifiers for the get_app_state and action tools. These tools are designed to interact with running applications on the host system, granting capabilities such as reading accessibility trees, capturing screenshots, and driving user interface elements. When an attacker provides a case-variant identifier, the application fails to recognize it as belonging to the denied list of password managers. Consequently, the security filter does not trigger its blocking mechanism, allowing the MCP caller to proceed with operations that require high-level system permissions. This flaw effectively neutralizes one of the primary defense layers intended to protect user credentials and sensitive data from unauthorized automated access by AI agents or other local processes.
The operational impact of this vulnerability is severe, particularly in scenarios involving prompt injection attacks where an attacker manipulates a large language model into executing malicious commands. Once inside the system through such social engineering vectors, the ability to bypass the denylist enables the extraction of sensitive information from unlocked password manager interfaces. Attackers can read accessibility trees to extract text content, capture screenshots to visually inspect data, and drive UI elements to perform actions like logging in or copying credentials. This level of access compromises the confidentiality and integrity of user accounts stored within these managers, potentially leading to broader account takeovers if those passwords are reused across other services. The risk is amplified by the fact that macOS accessibility features provide deep system-level visibility, making them a high-value target for exploitation.
This vulnerability aligns with CWE-20 Improper Input Validation and CWE-183 Permissive List of Allowed Inputs, as the application fails to normalize or strictly validate input against an allowlist while incorrectly assuming case-insensitive matching is sufficient for security decisions. In terms of threat modeling, this falls under MITRE ATT&CK technique T1505.003 Server Component Installation and potentially relates to T1078 Valid Accounts if the attacker leverages existing user sessions. To mitigate this risk, developers must implement strict case-sensitive comparisons when checking bundle identifiers against security denylists or normalize all inputs to a canonical lowercase format before validation. Additionally, implementing principle of least privilege by restricting MCP tool access based on explicit allowlists rather than relying solely on negative filtering can reduce the attack surface. Users should ensure they are running patched versions that address this logic error and monitor for unusual activity from local AI agents interacting with system accessibility features.