Microsoft UFO CVE-2026-73297

The attacker must be able to influence URLs that are passed to UFO's validate_url function - for example, by providing input to an agentic workflow where UFO evaluates or fetches externally-derived URLs as part of its automation logic. The CVSS 4.0 AT:P metric reflects this prerequisite. No authentication is required (PR:N), and the technique works against default configurations of the UFO framework when the above input path is accessible. Exploitation is most impactful in cloud-hosted deployments with access to instance metadata services (AWS IMDSv1, Azure IMDS, GCP metadata server) because these services return credentials without additional authentication. Deployments where UFO never processes external or user-controlled URL inputs, or where outbound egress to link-local and internal subnets is blocked at the network layer, have substantially reduced exposure. The vulnerable system itself has no direct confidentiality, integrity, or availability impact; all attacker gain is realized through the reachable subsequent systems (SC:H).

The CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N, score 6.9) accurately captures the threat profile: network-accessible, low complexity, no credentials required, but with Attack Requirements Present (AT:P), meaning the attacker must be positioned to supply URLs to the validate_url function - a realistic condition in UFO's agentic automation workflows that process external or user-derived URLs. The subsequent-system confidentiality impact is High (SC:H), reflecting that cloud metadata endpoints routinely expose IAM credentials, API keys, and service tokens that enable lateral movement far beyond the UFO process itself. No CISA KEV listing is present and no EPSS score was provided, indicating no confirmed widespread exploitation at time of analysis. The IPv6 transition SSRF bypass technique requires no specialized tooling and is catalogued in public SSRF research, making the effective exploitation complexity lower than AC:L alone suggests. The primary risk limiter is the AT:P prerequisite: deployments where UFO does not accept external URL input face little practical exposure, while cloud-hosted agentic deployments processing untrusted URLs are at material risk of metadata credential theft.

An attacker with the ability to inject a URL into a UFO agentic workflow submits http://[64:ff9b::169.254.169.254]/latest/meta-data/iam/security-credentials/role-name as a target. The _is_blocked_ip guard evaluates the address as a global unicast IPv6 address - not matching any blocked private IPv6 prefix - and allows the fetch. UFO retrieves temporary AWS IAM credentials from the instance metadata service and returns them within the workflow result, which the attacker then uses to escalate access within the cloud environment. No public proof-of-concept exploit exists at time of analysis, but the NAT64 SSRF bypass technique is well-documented in published research.