CVE-2026-81735 is a critical vulnerability affecting several components of the UI-TARS ecosystem. The startServer.ts module in the mcp-http-server package defaults to binding all network interfaces when no host is specified, and authentication middleware is not enforced when not explicitly provided. This results in unauthenticated access to the Streamable HTTP and SSE MCP transports. The affected libraries include mcp-http-server, ui-tars-desktop, mcp-server-commands, mcp-server-filesystem, and startserver.ts. The vulnerability allows attackers to execute commands and access sensitive data without credentials. This poses a high risk to systems using these components, as exploitation could lead to unauthorized control or data exposure. Users are strongly advised to apply the latest patches and update all affected software immediately. Verify that authentication middleware is properly configured and enforce host-specific bindings to mitigate risk. Organizations should conduct network monitoring for suspicious activity and ensure secure configurations are in place.