EUVD-2026-44943Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Network-reachable WebSocket server requires authenticated DEVICE registration (PR:L); impact is limited to peer device metadata disclosure with no integrity or availability consequences.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
4DescriptionCVE.org
Microsoft UFO open-source framework for intelligent automation across devices and platforms. From 3.0.0 until 3.0.6, a client connected to the UFO WebSocket server as a DEVICE could call DEVICE_INFO_REQUEST with another device's target_id and receive that device's server-side system_info through ufo/server/ws/handler.py, because handle_device_info_request and get_device_info did not enforce the constellation-only role or object-level authorization boundary. This issue is fixed in version 3.0.6.
AnalysisAI
Cross-device system_info disclosure in Microsoft UFO's WebSocket server allows any authenticated DEVICE-role client to retrieve another enrolled device's server-side system_info - including hostname, IP address, and metadata tags - by supplying an arbitrary target_id in a DEVICE_INFO_REQUEST message. Affected versions 3.0.0 through 3.0.5 authenticate the caller's role but omit object-level authorization in handle_device_info_request and get_device_info (ufo/server/ws/handler.py), meaning DEVICE clients can enumerate peers that only CONSTELLATION controllers should be able to query. No public exploit identified at time of analysis; vendor-released patch is version 3.0.6.
Technical ContextAI
Microsoft UFO is an open-source Python framework orchestrating AI-driven automation tasks across heterogeneous endpoints via a WebSocket server. Connected clients register under one of two roles: DEVICE (the managed endpoint) or CONSTELLATION (the orchestrating controller scoped to a specific device). Message dispatch in ufo/server/ws/handler.py routes DEVICE_INFO_REQUEST messages to handle_device_info_request, which was intended as a CONSTELLATION-only operation. CWE-639 (Authorization Bypass Through User-Controlled Key) precisely describes the root cause: the dispatcher verified the caller was authenticated but never validated that (1) the caller held the CONSTELLATION role, or (2) the caller's target_id corresponded to a device it legitimately manages. The commit diff (2558da4e) adds regression tests confirming that DEVICE-role callers must receive an error response and that victim system_info fields such as hostname and IP address must never appear in attacker-bound WebSocket frames. CPE cpe:2.3:a:microsoft:ufo:*:*:*:*:*:*:*:* identifies the affected artifact as the microsoft/UFO GitHub project.
RemediationAI
Upgrade to Microsoft UFO version 3.0.6, which enforces constellation-only role checks and object-level authorization boundaries in handle_device_info_request and get_device_info (patch commit https://github.com/microsoft/UFO/commit/2558da4e7dd05096aa6b489eca64efed96126713; release https://github.com/microsoft/UFO/releases/tag/3.0.6). For deployments unable to upgrade immediately, restrict network access to the UFO WebSocket server port to trusted hosts via firewall or network policy, reducing the pool of clients that could register as DEVICE-role attackers. Additionally, audit the DEVICE client registry for unauthorized or unexpected enrollments - any unrecognized DEVICE client on a pre-3.0.6 deployment should be treated as a potential source of cross-device enumeration. No configuration-only workaround exists that preserves DEVICE_INFO_REQUEST functionality without patching the handler logic.
Missing authentication in Microsoft UFO's mobile MCP servers lets an unauthenticated remote attacker fully control an AD
DNS rebinding against Microsoft UFO's Linux MCP server (all versions prior to 3.0.8) enables an attacker-controlled web
Server-side request forgery in Microsoft UFO's URL validation layer allows unauthenticated remote attackers to bypass th
Session-squatting and memory exhaustion in Microsoft UFO's WebSocket server allow any authenticated client to permanentl
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today