CVE-2026-105788

Executive Summary

CVE-2026-105788 is an OS command injection vulnerability (CWE-78) in Microsoft UFO, an open-source intelligent automation framework, affecting versions prior to 3.0.10. The type_text and launch_app tools in ufo/client/mcp/http_servers/mobile_mcp_server.py pass caller-controlled text and package_name parameters into adb shell command argument positions without comprehensive validation, allowing shell metacharacters to execute additional commands on an authorized connected Android device. With a CVSS score of 8.8, exploitation requires a valid Mobile MCP API key and a reachable ADB-authorized device, resulting in high confidentiality, integrity, and availability impact limited to Android shell-user privileges.

Technical Analysis

Microsoft UFO is an open-source framework designed for intelligent automation across devices and platforms. The vulnerability resides in the Mobile MCP (Model Context Protocol) HTTP server component, specifically within the type_text and launch_app tools located in ufo/client/mcp/http_servers/mobile_mcp_server.py.

The core issue is a failure to properly validate caller-controlled input before it is passed to the Android Debug Bridge (ADB) command-line interface. The type_text tool accepts a text parameter, and the launch_app tool accepts a package_name parameter. Both parameters are derived from the authenticated caller and are inserted directly into adb shell command argument positions.

The critical mechanism is that the ADB client does not treat these arguments as discrete, safely-escaped tokens. Instead, the ADB client joins the arguments into a single remote command string that is subsequently reparsed by the Android shell (the shell running on the connected Android device). Because the Android shell reinterprets the command string, shell metacharacters embedded in the text or package_name values — such as ;, |, &, backticks, or $() — can be interpreted by the shell to execute additional commands. This is a classic command injection pattern where the vulnerable application (the mobile MCP server) fails to neutralize special elements before passing them to a downstream command interpreter (the ADB client plus Android shell).

The attack surface is the HTTP interface exposed by the Mobile MCP server. The caller must possess a valid Mobile MCP API key to authenticate to the server. The device must be reachable and authorized for ADB (that is, the target Android device must have already been paired and permitted for debugging by the ADB client running the UFO framework). The CVSS vector indicates network attack vector (AV:N), low attack complexity (AC:L), low privileges required (PR:L — consistent with the need for an API key and an authorized device), no user interaction (UI:N), and unchanged scope (S:U). The impact subscores are all High (C:H/I:H/A:H), reflecting that an attacker can read, modify, and disrupt data or services within the Android shell-user context.

Several important boundaries constrain the vulnerability. Exploitation does not establish host operating-system execution on the machine running the UFO framework. It does not establish Android root execution. It does not grant access beyond the privileges of the Android shell user on the connected device. These limitations are explicitly documented in the CVE description, which is significant for scoping the blast radius: an attacker gains code execution only on the paired Android device under the shell user's rights, not on the UFO host and not with elevated Android privileges. Nevertheless, the Android shell user is a powerful context on many devices and can access application data, user files, and system settings available to that user, resulting in the High impact ratings.

The vulnerability class is command injection. No specific details about the exact escape sequences, the ADB argument-joining logic, or the validation routine are available in the provided description, and none should be inferred beyond what is stated. The fix is identified as version 3.0.10, which presumably strengthens input validation or properly escapes arguments before passing them to ADB.

Exploitation Scenarios

No public proof-of-concept, exploit code, or Nuclei template is available for CVE-2026-105788. The attack chain below is inferred at the vulnerability-class level from the NVD description. No specific function names, parameter names, or code patterns beyond those explicitly stated (type_text, launch_app, text, package_name, adb shell) are invented.

1. Reconnaissance and target identification. An attacker identifies a reachable Microsoft UFO Mobile MCP HTTP server. Because exploitation requires a valid Mobile MCP API key, the attacker must either possess legitimate API credentials (for example, a malicious insider or a compromised integration) or obtain them through separate means. The attacker also requires a target Android device that is reachable and already authorized for ADB by the UFO deployment. This means the attack is most plausible against environments where UFO is deployed to automate a fleet of Android devices and where an API key has leaked or is otherwise accessible to the attacker.

2. Triggering the flaw class. The attacker sends an authenticated request to the Mobile MCP HTTP server invoking the type_text tool with a crafted text parameter, or the launch_app tool with a crafted package_name parameter. The crafted value contains shell metacharacters. Because the server does not comprehensively validate the input, the malicious value is passed into the adb shell command argument positions.

3. Payload execution at the vulnerability-class level. The ADB client joins the supplied arguments into a remote command string. When that string is delivered to the Android device, the Android shell reparses it. The injected shell metacharacters cause the shell to execute additional commands beyond the intended type_text or launch_app operation. The additional commands run as the Android shell user on the connected device. The precise syntax of the injected payload depends on the metacharacters and the surrounding command structure, which are not detailed in the available description.

4. Post-exploitation impact. The attacker achieves arbitrary command execution as the Android shell user on the authorized device. This permits reading and exfiltrating data accessible to that user, modifying or deleting files, altering device state, and disrupting services — consistent with the High confidentiality, integrity, and availability impact ratings. The attacker cannot pivot to the UFO host operating system, cannot obtain Android root, and cannot exceed shell-user privileges on the device.

The requirement for a valid API key and an ADB-authorized device materially reduces the likelihood of opportunistic mass exploitation. The realistic threat model is a malicious insider, a compromised or leaked API key, or an attacker who has already gained a foothold in the automation environment. As of this report, there is no evidence of exploit-in-the-wild activity and the CVE is not listed in CISA KEV.

Impact Assessment

The CVSS v3.1 base score is 8.8 (High), with vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. The network attack vector means the flaw can be triggered remotely over the Mobile MCP HTTP interface. Low attack complexity indicates no specialized conditions beyond the stated prerequisites. Low privileges required reflects the need for a valid Mobile MCP API key and an ADB-authorized device — a meaningful bar, but one that may be satisfied in insider or compromised-credential scenarios. No user interaction is required, so an attacker does not need a victim to click or approve anything.

The scope is unchanged, meaning the impact is confined to the vulnerable component's security authority (the Android shell-user context on the connected device). All three impact metrics are High: confidentiality, because an attacker can read data available to the shell user; integrity, because an attacker can modify files and device state; and availability, because an attacker can disrupt or terminate services on the device.

The business blast radius centers on organizations using Microsoft UFO to automate Android devices. The affected asset is the Android device (and the data and applications reachable by its shell user), not the UFO host. However, if the automated mobile device manages sensitive data — enterprise mobile applications, test environments containing production credentials, or devices used for customer-facing operations — the exposure can be significant. Because the attack requires credentials and an authorized device, the primary risk is to environments with broadly shared API keys, weak key management, or untrusted operators. Organizations that expose the Mobile MCP HTTP server to broader networks without strong credential controls face elevated risk.

Detection Guidance

Sigma Rule

title: Microsoft UFO Mobile MCP Command Injection Attempt
id: 8b6f2c1a-4d3e-4a7b-9c2f-1e5a7d3b9f01
status: experimental
description: Detects command injection attempts against Microsoft UFO Mobile MCP tools type_text and launch_app prior to version 3.0.10
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-105788
author: valtersit.com
date: 2026-01-01
logsource:
  category: application
  product: ufo
detection:
  selection_tool:
    - 'type_text'
    - 'launch_app'
  selection_meta:
    - ';'
    - '|'
    - '&&'
    - '$('
    - '`'
  condition: selection_tool and selection_meta
fields:
  - text
  - package_name
  - source_ip
falsepositives:
  - Legitimate text containing shell-like characters typed into applications
level: high

YARA Rule

rule CVE_2026_105788_UFO_MCP_Command_Injection
{
    meta:
        description = "Detects shell metacharacter injection payloads targeting Microsoft UFO Mobile MCP type_text and launch_app tools"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-105788"
        date = "2026-01-01"
        severity = "high"
    strings:
        $mcp1 = "type_text" ascii nocase
        $mcp2 = "launch_app" ascii nocase
        $mcp3 = "mobile_mcp_server" ascii nocase
        $meta1 = ";" ascii
        $meta2 = "&&" ascii
        $meta3 = "|" ascii
        $meta4 = "$(" ascii
        $meta5 = "`" ascii
    condition:
        any of ($mcp*) and 2 of ($meta*)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-105788 Microsoft UFO Mobile MCP Command Injection Attempt"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"mcp"; http.request_body; content:"type_text"; http.request_body; pcre:"/(;|\||&&|\$\(|`)/"; sid:2026105788; rev:1; reference:cve,2026-105788; classtype:attempted-user; metadata:service http;)

Elastic Detection

sequence by process.entity_id with maxspan=1m
  [process where process.name == "adb" and process.args : "shell"]
  [process where process.parent.name == "adb" and process.command_line : ("*;*" or "*|*" or "*/*") and
   process.args_count > 0]

Splunk SPL Query

index=ufo OR index=application sourcetype=ufo:mcp
| search tool="type_text" OR tool="launch_app"
| eval malicious=if(match(coalesce(text, package_name), "[;|&`]|\$\("), 1, 0)
| where malicious=1
| table _time, src_ip, user, tool, text, package_name, malicious
| sort - _time

Wazuh OSSEC Rule

<group name="ufo,mcp,command_injection,">
  <rule id="100788" level="12">
    <decoded_as>json</decoded_as>
    <field name="tool">type_text|launch_app</field>
    <regex field="text">[;|&`]|\$\(</regex>
    <description>CVE-2026-105788: Microsoft UFO Mobile MCP command injection attempt detected</description>
    <mitre>
      <id>T1059</id>
    </mitre>
    <group>command_injection,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations

   • Upgrade Microsoft UFO to version 3.0.10 or later, which the CVE description identifies as the fixed release. Until upgrade is possible, restrict access to the Mobile MCP HTTP server to trusted networks and trusted operators.
   • Rotate and tightly control Mobile MCP API keys. Because exploitation requires a valid API key, enforcing strong, unique, non-shared credentials and monitoring their use reduces exposure.
   • Limit which Android devices are authorized for ADB. Remove authorization for devices that do not require automation, and use dedicated, least-privilege devices for UFO-managed workflows.
   • Where feasible, deploy input filtering at the Mobile MCP HTTP boundary that rejects shell metacharacters in the text and package_name fields. Note this is a compensating control, not a substitute for the upstream fix.

2. Patch/upgrade steps

   • Identify all deployed instances of Microsoft UFO and their versions.
   • Upgrade to version 3.0.10 or later from the official distribution channel.
   • Restart the Mobile MCP server and verify the running version.
   • Re-validate that only intended devices remain ADB-authorized after the upgrade.

3. Long-term hardening

   • Adopt secure coding practices that avoid passing caller-controlled input into shell argument positions; prefer tokenized, non-shell invocation APIs for ADB rather than string-based adb shell command construction.
   • Implement and enforce API key lifecycle management, including rotation, scoping, and monitoring for anomalous tool invocation patterns.
   • Apply network segmentation to isolate automation infrastructure and Android devices from general corporate networks.
   • Continuously monitor vulnerability feeds for CVE-2026-105788 patch confirmation and re-assess patch confidence as vendor evidence becomes available.

References

• NVD — CVE-2026-105788: https://nvd.nist.gov/vuln/detail/CVE-2026-105788
• Microsoft UFO (open-source project) — vendor repository and release notes for version 3.0.10
• CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection'): https://cwe.mitre.org/data/definitions/78.html
• MITRE ATT&CK T1059 — Command and Scripting Interpreter: https://attack.mitre.org/techniques/T1059/
• CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog (CVE-2026-105788 not currently listed)

No public proof-of-concept, exploit code, or Nuclei template is available. There is no evidence of exploit-in-the-wild activity or attribution to a known threat actor campaign as of this report.