Microsoft UFO: Server-side request forgery via WebSocket redirects
Summary
Microsoft UFO before 3.0.9 contains a Server-Side Request Forgery (SSRF) flaw in the Galaxy device registration. An attacker with a valid account that can call the device registration API can supply a WebSocket endpoint that redirects connections to internal hosts reachable from the UFO server. The confirmed impact is limited to opening an internal connection and sending a WebSocket handshake request; response data, arbitrary HTTP methods and cloud metadata access are not established.
Affected
- Microsoft UFO versions before 3.0.9
Fixed in
- Fixed in version 3.0.9
Workaround
Unknown.
Exploitation
- CISA SSVC: exploitation status "poc" (proof of concept), automatable: no
- Not listed in CISA KEV
- No confirmed exploitation in the wild known
Our recommendation
- Upgrade Microsoft UFO to version 3.0.9 or a later release.
- Restrict access to the device registration API to trusted users and networks.
- Check whether the UFO server is reachable from the internet or used by untrusted accounts.
- Monitor logs for unusual device registrations and outgoing WebSocket connections from the server.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-3pgm-xw75-hq27 github.com
- UFO Release v3.0.9 github.com
- OSV: CVE-2026-105790 osv.dev
- OpenCVE: CVE-2026-105790 app.opencve.io
- Fix commit f31fb5e github.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 5 Nov 2026, 19:41.
Original description (NVD)
Microsoft UFO is an open-source framework for intelligent automation across devices and platforms. Prior to 3.0.9, authenticated device registration through /api/devices can supply a permitted attacker-controlled WebSocket endpoint while aip/transport/websocket.py applies pinned_addresses only to the initial destination. The pinned websockets.connect() client follows cross-origin redirects and opens a new TCP connection before Galaxy performs its post-handshake peer-IP validation, allowing WebSocket upgrade requests to internal hosts reachable from the server. The confirmed impact is the internal connection and handshake request, and does not establish arbitrary HTTP methods, response-body disclosure, a completed AIP session, or cloud metadata access. This issue is fixed in version 3.0.9.
NVD references (7)
- https://github.com/microsoft/UFO/commit/f31fb5ef7d07b7825a03fe34b88f1f21cb5cfd35
- https://github.com/microsoft/UFO/releases/tag/v3.0.9
- https://github.com/microsoft/UFO/security/advisories/GHSA-3pgm-xw75-hq27
- https://github.com/microsoft/UFO/security/advisories/GHSA-3pgm-xw75-hq27
- https://github.com/microsoft/UFO/security/advisories/GHSA-3pgm-xw75-hq27
- https://github.com/microsoft/UFO/security/advisories/GHSA-3pgm-xw75-hq27
- https://github.com/microsoft/UFO/security/advisories/GHSA-3pgm-xw75-hq27
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.