CVE-2026-54568
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk42th percentile - higher than 42% of all known CVEs
Summary
In Microsoft UFO framework versions 3.0.0 through 3.0.6, a vulnerability was found due to missing object-level authorization. A client connected as a DEVICE to the WebSocket server could send a DEVICE_INFO_REQUEST with another device's target_id and obtain its system information.
Risk Assessment
The organization is at risk of leaking sensitive system information about devices, which could enable further attacks or privacy breaches.
Recommendation
Immediately update Microsoft UFO framework to version 3.0.6, which contains the fix for this vulnerability.
Other vulnerabilities in Microsoft UFO
See all- CVE-2026-73297Medium
Microsoft UFO framework before version 3.0.8 does not block NAT64, 6to4, and Teredo prefixes and does not re-check embedded IPv4 addresses, allowing a remote attacker to bypass the SSRF guard and reach cloud metadata, internal services, or localhost.
- CVE-2026-55440Medium
In the Microsoft UFO framework before version 3.0.7, the COMMAND_RESULTS handler calls get_or_create_session without owner_client_id, allowing an authenticated client to create a session with an arbitrary name (e.g., constellation_task_id = f"{task_name}@{task_id}"). This can lead to denial of service for the legitimate owner or memory exhaustion from phantom sessions.
- CVE-2026-73296Critical
Microsoft UFO framework before version 3.0.8 exposes Streamable HTTP MCP services on TCP ports 8020 and 8021 without authentication. This allows an unauthenticated remote attacker to invoke functions such as screenshot capture, taps, swipes, text typing, app launching, and modifying device state on an ADB-connected Android device.
- CVE-2026-62316High
Microsoft UFO, an open-source framework for intelligent automation, prior to version 3.0.8, contains an MCP server on localhost:8010 that does not validate Host, Origin, or Sec-Fetch-Site headers. An attacker-controlled web page can use DNS rebinding to reach the local /mcp endpoint, enumerate tool schemas, and invoke execute_command with a valid UFO_MCP_API_KEY, allowing reading files or executing allowed OS commands as the victim's user. This issue is fixed in version 3.0.8.
Original NVD description (English source)
Microsoft UFO open-source framework for intelligent automation across devices and platforms. From 3.0.0 until 3.0.6, a client connected to the UFO WebSocket server as a DEVICE could call DEVICE_INFO_REQUEST with another device's target_id and receive that device's server-side system_info through ufo/server/ws/handler.py, because handle_device_info_request and get_device_info did not enforce the constellation-only role or object-level authorization boundary. This issue is fixed in version 3.0.6.