CVE-2026-105789

Executive Summary

CVE-2026-105789 affects Microsoft UFO, an open-source framework for intelligent automation across devices and platforms, specifically versions prior to 3.0.9. The vulnerability resides in the execute_command tool within ufo/client/mcp/http_servers/linux_mcp_server.py, where the command allow-list incorrectly classifies sort and uniq as strictly read-only operations while permitting free-form command parameters capable of file-output forms. An authenticated caller can leverage sort -o or the optional second uniq operand to create or overwrite files writable by the UFO server process without using shell metacharacters, leading to data corruption or service disruption.

Technical Analysis

The core issue is a command argument injection flaw (CWE-88) within Microsoft UFO's Model Context Protocol (MCP) HTTP server implementation for Linux. The execute_command tool in ufo/client/mcp/http_servers/linux_mcp_server.py maintains an argument policy that designates certain binaries as "read-only." This classification is intended to prevent write operations, but it is based on the binary name rather than a semantic analysis of the provided arguments. Both sort and uniq exhibit legitimate, documented write capabilities through their file-output forms: sort -o <file> writes sorted output directly to a destination file (opening that file itself), and uniq accepts an optional second operand specifying an output file. Because the argument policy does not reject these operands, the free-form command parameter allows an authenticated caller to supply them. The destination path is opened by the allowed binary itself, not by a shell, so shell metacharacter filters are bypassed. The CVSS vector (CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:L) indicates the attack is network-accessible, requires high complexity, low privileges (authenticated), and user interaction (the victim must presumably trigger or approve the command in the automation workflow). Integrity impact is high due to file corruption/overwrite potential; availability impact is low (service disruption); confidentiality impact is none, as the demonstrated primitive does not disclose files. The vulnerability class is argument injection via a flawed allow-list, not a memory-safety issue or remote code execution. No public proof-of-concept, exploit code, or Nuclei template is available, and the CVE has not been scored by FIRST.org EPSS or added to CISA KEV.

Exploitation Scenarios

No public PoC is available; the attack chain is inferred from the vulnerability class (argument injection in a command allow-list).

1. Reconnaissance / Target Identification: The attacker identifies a reachable instance of the Microsoft UFO MCP HTTP server running linux_mcp_server.py with access to the execute_command tool. Since the tool is part of an authenticated MCP endpoint, the attacker must possess or obtain valid credentials (PR:L). Network exposure (AV:N) means the server may be reachable from adjacent networks or the internet if misconfigured.

2. Triggering the Flaw: Through the MCP interface, the attacker submits a command invocation that passes sort or uniq as the executable and includes file-output operands. For sort, the operand -o /path/to/destination is supplied; for uniq, a second positional operand specifying the output file is supplied. The argument policy does not reject these because the binaries are classified as read-only and the check does not inspect output redirection operands. The attacker does not need shell metacharacters (>, |, ;), so filters targeting those characters are ineffective.

3. Payload / Execution Method: The allowed binary opens the destination file itself and writes the processed input to it. The attacker controls the destination path within the permissions of the UFO server process. The content written is derived from the input stream to sort or uniq, which may be trivially small or empty, but the file creation/overwrite effect is the core primitive. No arbitrary code execution or file disclosure occurs at this stage.

4. Post-Exploitation Impact: The attacker can create or overwrite any file writable by the UFO server process, including configuration files, state data, or other writable artifacts. This can corrupt configurations, disrupt the service, or prepare for follow-on attacks that rely on modifying trusted data. The CVSS scores reflect high integrity impact and low availability impact, with no confidentiality loss.

Impact Assessment

The vulnerability allows an authenticated, low-privileged caller to corrupt or overwrite files on the system hosting the Microsoft UFO MCP server. Business impact includes service disruption if configuration or state files are overwritten, potential loss of automation integrity, and an expanded attack surface for chained attacks that manipulate writable data. Affected systems are those running Microsoft UFO versions prior to 3.0.9 with the linux_mcp_server.py component exposed and reachable. Because the scope is unchanged (S:U), the blast radius is limited to the UFO server process and its writable files, not the underlying host OS. The high attack complexity (AC:H) and requirement for user interaction (UI:R) reduce the likelihood of mass exploitation; however, targeted attacks against automation infrastructure remain plausible. No exploit-in-the-wild or threat actor campaign is known.

Detection Guidance

Sigma Rule

title: Microsoft UFO Command Argument Injection via sort/uniq File-Output
id: 8f2a1b3c-4d5e-6f7a-8b9c-0d1e2f3a4b5c
status: experimental
description: Detects attempts to exploit CVE-2026-105789 by invoking sort -o or uniq with output operand through the UFO execute_command tool
author: Threat Intelligence
date: 2026-01-01
logsource:
  product: linux
  service: auditd
detection:
  selection:
    type: 'EXECVE'
    a0|endswith:
      - '/sort'
      - '/uniq'
    a1|contains:
      - '-o'
      - '--output'
  condition: selection
falsepositives:
  - Legitimate administrative use of sort -o or uniq output
level: medium
tags:
  - attack.t1190
  - cve.2026.105789

YARA Rule

rule CVE_2026_105789_UFO_Argument_Injection
{
    meta:
        description = "Detects references to vulnerable UFO linux_mcp_server sort/uniq file-output pattern"
        author = "Threat Intelligence"
        reference = "CVE-2026-105789"
        date = "2026-01-01"
        severity = "medium"
    strings:
        $s1 = "linux_mcp_server.py" ascii wide
        $s2 = "execute_command" ascii wide
        $s3 = "sort -o" ascii wide
        $s4 = "uniq" ascii wide
    condition:
        uint16(0) == 0x5A4D or uint32(0) == 0x464C457F
        and any of ($s1, $s2)
        and any of ($s3, $s4)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-105789 Microsoft UFO execute_command sort/uniq argument injection attempt"; flow:to_server,established; http.request_body; content:"execute_command"; nocase; http.request_body; content:"sort"; nocase; http.request_body; content:"uniq"; nocase; pcre:"/(?:-o\s|--output)/Ri"; reference:cve,2026-105789; classtype:attempted-admin; sid:2026105789; rev:1;)

Elastic Detection

process where event.type == "start" and
  process.parent.name in ("python", "python3", "ufo", "mcp") and
  process.name in ("sort", "uniq") and
  (process.args : "-o" or process.args : "--output")

Splunk SPL Query

index=linux sourcetype=auditd type=EXECVE
| search a0 IN ("*sort","*uniq") AND (a1="*-o*" OR a1="*--output*")
| table _time host a0 a1 a2 a3
| sort - _time

Wazuh OSSEC Rule

<group name="linux,microsoft_ufo,">
  <rule id="100789" level="10">
    <if_sid>80700</if_sid>
    <field name="audit.execve.a0">sort|uniq</field>
    <field name="audit.execve.a1">-o|--output</field>
    <description>CVE-2026-105789: Microsoft UFO execute_command argument injection attempt via sort/uniq file-output</description>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate Mitigations:

   • Restrict network access to the UFO MCP HTTP server (linux_mcp_server.py) to trusted management networks only.
   • Enforce strong authentication and least-privilege for any caller authorized to invoke execute_command.
   • Implement an outbound/argument-inspection proxy or wrapper that explicitly rejects sort/uniq invocations containing -o, --output, or a second positional operand.
   • Monitor file integrity for configuration and state files writable by the UFO server process using tools such as AIDE, Tripwire, or Wazuh FIM.

2. Patch/Upgrade Steps:

   • Upgrade Microsoft UFO to version 3.0.9 or later, where the issue is fixed.
   • Verify upgrade completion by confirming the linux_mcp_server.py argument policy no longer permits file-output forms for sort and uniq.
   • Since patch confidence is 0/4 with no tracked vendor advisory, validate the fix through code review or vendor communication before relying solely on the version number.

3. Long-term Hardening:

   • Replace binary-name allow-lists with strict argument schemas per allowed command, denying any operand that opens files for writing unless explicitly required.
   • Run the UFO MCP server in a sandbox or container with a read-only filesystem and minimal writable mounts.
   • Apply the principle of least privilege to the service account to limit the impact of arbitrary file overwrite primitives.
   • Conduct regular configuration and state data backups to enable rapid recovery from corruption.

References

• https://nvd.nist.gov/vuln/detail/CVE-2026-105789
• https://cwe.mitre.org/data/definitions/88.html
• https://github.com/microsoft/UFO (Microsoft UFO repository and release notes for version 3.0.9)
• https://www.first.org/epss/ (EPSS not yet scored for this CVE)
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog (CVE-2026-105789 not listed as of report date)