CVE-2026-73297
MediumCVSS 6.9Summary
Microsoft UFO framework before version 3.0.8 does not block NAT64, 6to4, and Teredo prefixes and does not re-check embedded IPv4 addresses, allowing a remote attacker to bypass the SSRF guard and reach cloud metadata, internal services, or localhost.
Risk Assessment
An attacker could exploit this to access sensitive internal resources, potentially leading to data leakage or further system compromise.
Recommendation
Update Microsoft UFO to version 3.0.8 or later, which includes the fix for blocking these prefixes and re-checking embedded IPv4 addresses.
Original NVD description (English source)
Microsoft UFO open-source framework for intelligent automation across devices and platforms. Prior to 3.0.8, _is_blocked_ip in ufo/utils/url_security.py did not block NAT64 prefixes 64:ff9b::/96 and 64:ff9b:1::/48, the 6to4 prefix 2002::/16, or the Teredo prefix 2001::/32 and did not re-check embedded IPv4 destinations, allowing an unauthenticated remote attacker who can influence URLs processed by validate_url to bypass the SSRF guard and reach cloud metadata, internal services, or localhost. This issue is fixed in version 3.0.8.