Skip to main content
OneCon26: Gain the advantage in the AI era. Oct. 20–22 in Las Vegas.Register Now
CVE Vulnerability Database
Vulnerability Database/CVE-2026-73297

CVE-2026-73297: Microsoft UFO Framework SSRF Vulnerability

CVE-2026-73297 is an SSRF flaw in Microsoft UFO framework that allows attackers to bypass security guards and access cloud metadata or internal services. This post explains its impact, affected versions, and mitigation steps.

Published:

CVE-2026-73297 Overview

CVE-2026-73297 is a Server-Side Request Forgery (SSRF) vulnerability [CWE-918] in Microsoft UFO, an open-source framework for intelligent automation across devices and platforms. Versions prior to 3.0.8 contain an incomplete SSRF guard in ufo/utils/url_security.py. The _is_blocked_ip function fails to block IPv6 transition prefixes, including the NAT64 well-known prefix 64:ff9b::/96, the NAT64 local-use prefix 64:ff9b:1::/48, the 6to4 prefix 2002::/16, and the Teredo prefix 2001::/32. The function also does not re-check embedded IPv4 destinations. An unauthenticated remote attacker who can influence URLs passed to validate_url can bypass the SSRF protection.

Critical Impact

Attackers can reach cloud metadata endpoints, internal services, and localhost from a vulnerable UFO deployment, exposing credentials, internal APIs, and sensitive automation infrastructure.

Affected Products

  • Microsoft UFO versions prior to 3.0.8
  • Deployments using ufo/utils/url_security.py with the validate_url function
  • Automation workflows that process attacker-influenced URLs

Discovery Timeline

  • 2026-08-12 - CVE-2026-73297 published to NVD
  • 2026-08-12 - Last updated in NVD database

Technical Details for CVE-2026-73297

Vulnerability Analysis

The vulnerability resides in the SSRF defense implemented by _is_blocked_ip inside ufo/utils/url_security.py. The function maintains a list of private and reserved IP networks that should be rejected before an HTTP request is issued. This list omits several IPv6 transition mechanisms that can route back to IPv4 address space, including internal ranges and cloud metadata endpoints.

Because the guard does not extract and re-validate the IPv4 destination embedded within these IPv6 addresses, an attacker can craft a URL that appears external at the IPv6 layer while resolving traffic to blocked IPv4 targets. This bypass gives an unauthenticated remote attacker the ability to instruct UFO to fetch resources from restricted network locations.

Root Cause

The root cause is incomplete deny-list coverage combined with missing recursive validation. IPv6 transition addressing encapsulates or maps IPv4 destinations inside IPv6 prefixes. NAT64 (64:ff9b::/96), 6to4 (2002::/16), and Teredo (2001::/32) all encode IPv4 addresses within the IPv6 address. The pre-patch _is_blocked_ip did not enumerate these prefixes and did not decode the embedded IPv4 destination to check it against the blocked networks list.

Attack Vector

The attack is network-based and requires no authentication or user interaction. An attacker submits a URL to any UFO code path that calls validate_url. The URL uses an IPv6 host in one of the unblocked transition prefixes, with an embedded IPv4 target such as 169.254.169.254 (cloud instance metadata) or 127.0.0.1 (localhost). The SSRF guard returns False for _is_blocked_ip, and UFO issues the request against internal infrastructure.

python
# Security patch in ufo/utils/url_security.py (v3.0.8)
# Source: https://github.com/microsoft/UFO/commit/96983c73ed09e884a5f1d7ff8936c953b234b684

# Private/reserved IP networks that should be blocked for SSRF protection.
# Explicit IPv6 transition/relay prefixes that should be blocked deterministically.
# These are kept as named constants for clarity and to match the SDD for Task 1.
_NAT64_WELL_KNOWN_NETWORK = ipaddress.ip_network("64:ff9b::/96")
_NAT64_LOCAL_USE_NETWORK = ipaddress.ip_network("64:ff9b:1::/48")
_SIX_TO_FOUR_NETWORK = ipaddress.ip_network("2002::/16")
_TEREDO_NETWORK = ipaddress.ip_network("2001::/32")


_BLOCKED_IP_NETWORKS = (
    # IPv4
    ipaddress.ip_network("0.0.0.0/8"),

The patch adds explicit named constants for each IPv6 transition prefix and integrates them into the blocked networks evaluation. See the GitHub Commit Update for full patch details.

Detection Methods for CVE-2026-73297

Indicators of Compromise

  • Outbound HTTP requests from UFO hosts targeting IPv6 addresses in the 64:ff9b::/96, 64:ff9b:1::/48, 2002::/16, or 2001::/32 ranges
  • Requests from UFO processes to cloud metadata endpoints such as 169.254.169.254 or Azure IMDS 169.254.169.254/metadata/instance
  • UFO log entries where validate_url accepted an IPv6-formatted host encoding an internal IPv4 destination
  • Unexpected access to localhost services (127.0.0.1, ::1) originating from the UFO agent

Detection Strategies

  • Inspect application logs from ufo/utils/url_security.py for URL validation events involving IPv6 hosts with embedded IPv4 addresses
  • Deploy network-layer detection to alert on outbound traffic from automation hosts to metadata service IPs
  • Correlate UFO process activity with DNS resolutions and outbound flows to identify anomalous internal destinations
  • Review UFO deployment version strings and flag any instance running below 3.0.8

Monitoring Recommendations

  • Enable verbose logging for the validate_url function to capture full URL inputs and validation decisions
  • Ingest UFO host telemetry into a centralized SIEM and build queries for the four transition prefixes noted above
  • Monitor egress firewall logs for connections to link-local, loopback, and RFC1918 address space from UFO workloads
  • Alert on any outbound request from UFO to cloud provider metadata endpoints regardless of protocol family

How to Mitigate CVE-2026-73297

Immediate Actions Required

  • Upgrade Microsoft UFO to version 3.0.8 or later using the release available at GitHub Release v3.0.8
  • Audit all code paths that invoke validate_url and confirm the patched module is loaded
  • Restrict UFO host egress at the network boundary to only required external destinations
  • Rotate any credentials that could have been exposed via metadata endpoints if compromise is suspected

Patch Information

Microsoft released the fix in UFO version 3.0.8. The patch adds explicit ipaddress.ip_network constants for NAT64, 6to4, and Teredo prefixes and updates _is_blocked_ip to reject them. Full technical context is available in the GitHub Security Advisory GHSA-7hrg-r8xr-p8gr.

Workarounds

  • Block outbound traffic to 64:ff9b::/96, 64:ff9b:1::/48, 2002::/16, and 2001::/32 at the host or perimeter firewall
  • Deny UFO host access to cloud metadata IPs including 169.254.169.254 and IPv6 equivalents
  • Place UFO deployments on network segments without direct routing to internal services or metadata endpoints
  • Disable or gate any UFO feature that accepts attacker-controlled URLs until the patch is applied
bash
# Configuration example: block IPv6 transition prefixes on Linux hosts running UFO
ip6tables -A OUTPUT -d 64:ff9b::/96 -j DROP
ip6tables -A OUTPUT -d 64:ff9b:1::/48 -j DROP
ip6tables -A OUTPUT -d 2002::/16 -j DROP
ip6tables -A OUTPUT -d 2001::/32 -j DROP

# Block cloud metadata endpoint
iptables -A OUTPUT -d 169.254.169.254 -j DROP

# Verify UFO version
pip show ufo | grep -i version

Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.

Default Legacy - Prefooter | Experience the World’s Most Advanced Cybersecurity Platform

Experience the Most Advanced Cybersecurity Platform

See how the world’s most intelligent, autonomous cybersecurity platform can protect your organization today and into the future.

Try SentinelOne