🚨 CVE-2026-73296 - UFO-Vuln 💥

Unauthenticated Mobile MCP access can expose Android screen data and provide remote UI-control capabilities through ADB.

⚠️ Security Notice

This repository is intended for authorized security research, vulnerability validation, defensive testing, and controlled laboratory environments only.

The included checker is designed to perform non-destructive authentication-boundary checks.

It does not:

• Execute arbitrary MCP tools
• Control an Android device
• Execute ADB commands against a real device
• Capture screenshots
• Inject taps or swipes
• Launch applications
• Modify device state
• Attempt destructive exploitation

📌 Vulnerability Overview

CVE: CVE-2026-73296

Product: Microsoft UFO

Component: Mobile MCP HTTP Servers

Severity: Critical

CVSS v3.1: 9.4

Affected versions: <= v3.0.7

Officially patched versions: None listed by the Microsoft UFO advisory at the time of this documentation.

CWE:

• CWE-306 — Missing Authentication for Critical Function
• CWE-862 — Missing Authorization

The vulnerability affects UFO's Mobile MCP data-collection and action servers when they are exposed over a network without appropriate authentication.

The official advisory identifies the vulnerable implementation as:

ufo/client/mcp/http_servers/mobile_mcp_server.py

The affected services expose Streamable HTTP MCP interfaces that can interact with an ADB-connected Android device.

If the services are remotely reachable and authentication is not enforced, an unauthenticated network client may be able to access sensitive device information and invoke Android UI-control functionality.

🎯 Executive Summary

Microsoft UFO is an AI-agent framework designed for intelligent automation and multi-device orchestration.

Its Mobile MCP functionality provides MCP servers for interacting with Android devices through ADB.

The vulnerable configuration exposes two important network services:

In affected versions, the Mobile MCP servers could be created without an authentication provider or request-level authorization check.

Consequently:

Remote Client
      │
      │ HTTP / MCP
      ▼
┌──────────────────────┐
│ Mobile MCP Server    │
│                      │
│ Authentication:      │
└──────────┬───────────┘
           │
           ▼
      ADB Interface
           │
           ▼
    Android Device

The security boundary between the remote network client and the ADB-backed functionality is therefore insufficiently protected.

🔥 Severity

CVSS v3.1

9.4 CRITICAL

Vector:

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L

Metrics

The vulnerability is particularly significant because exploitation does not inherently require:

• An authenticated UFO session
• A UFO/Galaxy API key
• A registered AIP client
• Browser interaction
• LLM cooperation
• User approval
• An existing agent task

The official advisory states that a network client able to reach the exposed service can initialize an MCP session and invoke its tools without presenting a credential.

🧩 Affected Versions

According to the official Microsoft UFO security advisory:

Affected:
    <= v3.0.7

Patched:
    None listed

The official repository currently lists 3.0.7 as a release.

Important: Do not claim that 3.0.8 is an officially patched release unless Microsoft publishes that information. The official security advisory currently lists no patched version.

🏗️ Vulnerable Architecture

The vulnerable functionality is implemented in:

ufo/client/mcp/http_servers/mobile_mcp_server.py

Important functions identified by the official advisory include:

Data Collection

create_mobile_data_collection_server
capture_screenshot
get_ui_tree
get_device_info
get_mobile_app_target_info
get_app_window_controls_target_info

Mobile Actions

create_mobile_action_server
tap
swipe
type_text
launch_app
press_key
click_control

The two HTTP services are associated with:

TCP/8020
TCP/8021

The advisory specifically identifies these services as the Mobile data-collection and action MCP servers.

🔬 Root Cause

The fundamental security problem is:

Powerful functionality
        +
Network exposure
        +
Missing authentication
        =
Unauthorized access

At the affected implementation, the Mobile MCP FastMCP servers were constructed without an authentication provider or equivalent request-level authorization enforcement.

Conceptually:

mcp = FastMCP(
    "Mobile MCP Server",
    host=host,
    port=port,
)

The problem is not simply the existence of MCP.

The problem is that a network-accessible interface exposes security-sensitive operations without requiring the caller to establish an authenticated identity.

🔗 Attack Flow

A simplified attack chain looks like this:

┌───────────────────┐
│ Unauthenticated   │
│ Network Client    │
└─────────┬─────────┘
          │
          │ HTTP
          ▼
┌─────────────────────────┐
│ Mobile MCP :8020/:8021  │
│                         │
│ Authentication missing  │
└───────────┬─────────────┘
            │
            │ MCP Tool
            ▼
┌─────────────────────────┐
│ Mobile MCP Tool         │
└───────────┬─────────────┘
            │
            │ ADB operation
            ▼
┌─────────────────────────┐
│ Android Device / ADB    │
└─────────────────────────┘

The important security transition is:

Unauthenticated network request
              ↓
       MCP functionality
              ↓
       ADB-backed action
              ↓
       Android device

📡 Exposed Services

Port 8020 — Data Collection

The data-collection server can expose functionality associated with:

capture_screenshot
get_ui_tree
get_device_info
get_mobile_app_target_info
get_app_window_controls_target_info

Potentially exposed information includes:

• Current screen contents
• UI hierarchy
• Device information
• Android version
• Device model
• Screen dimensions
• Display density
• Battery information
• Installed application information
• Window/control information

This creates a significant confidentiality risk.

🎮 Port 8021 — Mobile Actions

The action server exposes functionality associated with:

tap
swipe
type_text
launch_app
press_key
click_control

These operations can provide a remote caller with Android UI interaction capabilities.

Depending on the device state and accessible applications, this can potentially allow:

Remote input
     ↓
UI navigation
     ↓
Application interaction
     ↓
Device-state modification

The official advisory specifically describes these capabilities as remotely injectable Android UI actions.

📸 Confidentiality Impact

Unauthorized access to screen and UI information can potentially expose:

• Personal messages
• Authentication codes
• Passwords displayed on screen
• Email contents
• Application data
• Internal application information
• Sensitive documents
• Private notifications
• User activity

The exact impact depends on the Android device and applications accessible through the connected ADB environment.

🛠️ Integrity Impact

Unauthorized mobile actions may allow an attacker to:

Tap
Swipe
Type text
Press keys
Launch applications
Click UI controls

This can potentially modify application state or interact with workflows running on the device.

💥 Availability Impact

Repeated automated actions could:

• Interrupt automation
• Switch applications
• Navigate away from workflows
• Trigger unexpected UI actions
• Interfere with testing environments
• Disrupt an Android automation session

The CVSS assessment assigns Low availability impact, while confidentiality and integrity are rated High.

🧪 Safe Detection

This repository includes:

cve-2026-73296.py

The checker is intentionally designed as a non-destructive security assessment tool.

It checks:

TCP reachability
       ↓
HTTP response
       ↓
Authentication boundary
       ↓
SAFE / VULNERABLE / UNKNOWN

It does not invoke Mobile MCP tools.

🟢 SAFE

A SAFE result means the tested HTTP endpoint returned an authentication/authorization barrier such as:

HTTP 401
HTTP 403

Example:

[SAFE] Port 8020: authentication/authorization
       barrier detected

🔴 VULNERABLE

A VULNERABLE result means the tested HTTP endpoint responded successfully without presenting an authentication challenge.

Example:

[VULNERABLE] Port 8021:
HTTP endpoint responded without an authentication challenge

This should be treated as a potential exposure requiring confirmation.

🟡 UNKNOWN

An UNKNOWN result means the checker could not reliably determine the authentication state.

Examples:

TCP unreachable
TLS error
HTTP timeout
Unexpected HTTP response
Redirect

UNKNOWN should not be interpreted as either secure or vulnerable.

⚠️ Detection Limitations

This checker intentionally does not claim to prove exploitation.

A green result means:

Authentication protection was observed on the tested HTTP boundary.

It does not mathematically prove that the entire UFO deployment is secure.

Likewise, a red result indicates:

The tested endpoint responded without an authentication challenge.

It should be correlated with:

• UFO version
• Deployment configuration
• Network exposure
• MCP configuration
• Reverse proxies
• TLS configuration
• Firewall rules
• ADB connectivity

🚀 Usage

Clone the repository:

git clone https://github.com/0xBlackash/CVE-2026-73296.git
cd CVE-2026-73296

Install dependency:

python3 -m pip install requests

Syntax check:

python3 -m py_compile cve-2026-73296.py

Run against an authorized test system:

python3 cve-2026-73296.py 127.0.0.1

Example lab target:

python3 cve-2026-73296.py 192.168.56.10

For HTTPS with a laboratory/self-signed certificate:

python3 cve-2026-73296.py https://192.168.56.10 --no-verify-tls

🖥️ Example Output

Protected Endpoint

════════════════════════════════════════════════════════
  SECURITY ASSESSMENT
────────────────────────────────────────────────────────

  SAFE       : 2
  VULNERABLE : 0
  UNKNOWN    : 0

  ✓ AUTHENTICATION CHECK PASSED

Potential Exposure

════════════════════════════════════════════════════════
  SECURITY ASSESSMENT
────────────────────────────────────────────────────────

  SAFE       : 0
  VULNERABLE : 2
  UNKNOWN    : 0

  ⚠ POTENTIAL CVE-2026-73296 EXPOSURE

  → TCP/8020 responded without an authentication challenge.
  → TCP/8021 responded without an authentication challenge.

🧬 Source-to-Sink Model

The vulnerability can be understood as a source-to-sink security failure:

SOURCE
  │
  │ Unauthenticated network request
  ▼
MCP HTTP Server
  │
  │ Missing authentication/authorization
  ▼
MCP Tool
  │
  ▼
ADB-backed operation
  │
  ▼
ANDROID DEVICE

The intended security boundary should instead be:

Network Request
      │
      ▼
Authentication
      │
      ├──── INVALID ────► REJECT
      │
      ▼
Authorization
      │
      ├──── DENIED ─────► REJECT
      │
      ▼
MCP Tool
      │
      ▼
ADB

🔐 Recommended Remediation

The primary remediation is to enforce authentication at the Mobile MCP HTTP transport boundary.

Recommended security architecture:

                    ┌──────────────────┐
                    │ Authorized MCP   │
                    │ Client           │
                    └────────┬─────────┘
                             │
                        Bearer Token
                             │
                             ▼
                    ┌──────────────────┐
                    │ Authentication   │
                    │ Middleware       │
                    └────────┬─────────┘
                             │
                       Authorized?
                       /          \
                     NO            YES
                     │              │
                     ▼              ▼
                   REJECT       MCP Tool
                                    │
                                    ▼
                                   ADB

🔑 API Key Protection

The official advisory recommends an authentication design based around:

UFO_MCP_API_KEY

The security model should ensure:

1. A high-entropy secret is required.
2. The server fails closed if the credential is missing.
3. Invalid bearer credentials are rejected.
4. Authentication occurs before tool execution.
5. Credentials are not exposed as LLM-visible tool parameters.
6. Credential comparison should use constant-time comparison.
7. Remote deployments should use encrypted transport.
8. Localhost should remain the default where possible.

🌐 Network Exposure

Avoid exposing:

0.0.0.0:8020
0.0.0.0:8021

directly to untrusted networks.

Prefer:

127.0.0.1

for local-only deployments.

For legitimate remote access, consider:

Client
  │
  ▼
TLS / Private Tunnel
  │
  ▼
Authenticated Reverse Proxy
  │
  ▼
UFO MCP
  │
  ▼
ADB

Possible security controls include:

• TLS
• Authenticated reverse proxy
• VPN
• Private network
• SSH tunnel
• Network ACLs
• Firewall restrictions
• Strong API credentials

🧪 Regression Testing

A proper security regression suite should verify:

Test 1 — No credential

Request
   ↓
No Authorization header
   ↓
REJECT
   ↓
ADB not reached

Expected:

PASS

Test 2 — Invalid credential

Bearer: invalid-token
        ↓
      REJECT
        ↓
   ADB not reached

Expected:

PASS

Test 3 — Valid credential

Bearer: valid-token
        ↓
     ACCEPT
        ↓
     MCP Tool
        ↓
       ADB

Expected:

PASS

Test 4 — Missing server secret

UFO_MCP_API_KEY = missing

Expected:

Server fails closed

Test 5 — Credential placeholder

Unresolved environment variables should not accidentally become authentication credentials.

Expected:

Client initialization fails

🛡️ Defense-in-Depth

Authentication alone should not be considered sufficient.

Recommended controls:

                 Internet
                    │
                    X
                    │
              Firewall/VPN
                    │
                    ▼
              TLS / Proxy
                    │
                    ▼
              API Authentication
                    │
                    ▼
              Authorization
                    │
                    ▼
               MCP Server
                    │
                    ▼
                   ADB
                    │
                    ▼
             Android Device

🔎 Detection & Monitoring

Security teams should monitor for unexpected access to:

TCP/8020
TCP/8021

Look for:

• Unexpected source IP addresses
• Requests without authorization headers
• Repeated authentication failures
• Unusual MCP sessions
• Unexpected screenshot requests
• Repeated UI interaction calls
• Unexpected application launches
• Suspicious ADB activity

Useful network telemetry:

source_ip
destination_ip
destination_port
timestamp
HTTP_method
HTTP_status
user_agent
authorization_present
request_frequency

📋 Incident Response Checklist

If an exposed vulnerable instance is discovered:

1. Restrict network access

Immediately limit access to:

8020
8021

2. Disconnect unnecessary Android devices

If the service is not required, disconnect the associated ADB device.

3. Investigate logs

Look for:

Unknown source IPs
Unexpected MCP sessions
Unexpected device interactions
Unexpected application launches

4. Rotate credentials

If authentication secrets may have been exposed:

Generate a new high-entropy API key

5. Review device state

Check:

• Recently launched applications
• Modified application state
• Unexpected messages/input
• Suspicious UI activity

6. Update or apply the vendor's security guidance

Follow the latest Microsoft UFO security advisory and release information.

7. Re-test

Run the safe checker again after remediation.

🧰 Research Methodology

This project follows a defensive vulnerability-validation methodology:

1. Identify vulnerable component
          ↓
2. Determine network attack surface
          ↓
3. Identify missing security boundary
          ↓
4. Map exposed capabilities
          ↓
5. Build non-destructive detection
          ↓
6. Validate authentication behavior
          ↓
7. Document impact
          ↓
8. Apply remediation
          ↓
9. Regression test

📂 Repository Structure

Recommended project structure:

CVE-2026-73296/
│
├── README.md
│
├── poc/
│   └── cve-2026-73296.py
│
├── docs/
│   ├── technical-analysis.md
│   ├── remediation.md
│   └── detection.md
│
├── screenshots/
│   ├── safe.png
│   └── vulnerable.png
│
├── tests/
│   └── README.md
│
├── LICENSE
└── .gitignore

🧠 Key Security Lessons

1. MCP Is a Security Boundary

MCP servers should not be treated as harmless local utilities when they expose powerful operations over a network.

2. ADB Magnifies Impact

An MCP endpoint connected to ADB can become a bridge between:

Network
   ↓
Agent protocol
   ↓
ADB
   ↓
Android

The security requirements therefore need to cover the entire chain.

3. Localhost Defaults Matter

A service bound to:

127.0.0.1

has a fundamentally different exposure profile from:

0.0.0.0

Network binding should therefore be treated as a security configuration.

4. Authentication Must Happen Before the Sink

The critical invariant is:

UNTRUSTED REQUEST
       ↓
 AUTHENTICATION
       ↓
 AUTHORIZATION
       ↓
   MCP TOOL
       ↓
      ADB

Never:

UNTRUSTED REQUEST
       ↓
   MCP TOOL
       ↓
      ADB

📊 Vulnerability Summary

🏁 Conclusion

CVE-2026-73296 demonstrates the security risk created when powerful agent automation interfaces are exposed over a network without an appropriate authentication and authorization boundary.

The vulnerable Mobile MCP architecture creates a path from:

Unauthenticated Network Client
              ↓
          MCP Server
              ↓
          MCP Tools
              ↓
             ADB
              ↓
       Android Device

The resulting impact can include both confidentiality loss, through screen/UI/device information, and integrity impact, through remote Android UI interaction.

The most important defensive controls are:

Authentication
Authorization
TLS
Network isolation
Least privilege
Secure defaults
Continuous monitoring
Regression testing

📚 References

• Microsoft UFO security advisory — CVE-2026-73296 / GHSA-24fq-m9rr-g3mm
• Microsoft UFO repository
• Microsoft UFO release history
• CWE-306 — Missing Authentication for Critical Function
• CWE-862 — Missing Authorization
• CVSS v3.1

Official Microsoft UFO repository:

https://github.com/microsoft/UFO

Official security advisory:

https://github.com/microsoft/UFO/security/advisories/GHSA-24fq-m9rr-g3mm

⚖️ Responsible Use

This project is provided for:

• Authorized penetration testing
• Security research
• CTF environments
• Vulnerability validation
• Defensive engineering
• Security education
• Detection development

Do not test systems or devices without explicit authorization.

The safe checker intentionally avoids executing the vulnerable Mobile MCP capabilities against real Android devices.

CVE-2026-73296 • Microsoft UFO • Mobile MCP Security Research