CVE-2026-105790— Microsoft UFO: Authenticated Galaxy device registration can bypass WebSocket SSRF IP pinning via redirects
Quick assessment
Affected
microsoft UFO
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Microsoft UFO 是一个跨设备和平台的智能自动化开源框架。在 3.0.9 版本之前，通过 端点进行经过身份验证的设备注册时，攻击者可以提供一个允许其控制的 WebSocket 端点。与此同时， 模块仅在初始目标地址上应用了 校验机制。由于 客户端在连接过程中会跟随跨源重定向，并在 Galaxy 执行握手后的对等 IP 验证之前建立新的 TCP 连接，攻击者可将 WebSocket 升级请求重定向至服务器可访问的内部主机。 经确认，该漏洞的实际影响仅限于建立内部连接和握手请求，无法实现任意 HTTP 方法调
Possible ATT&CK Techniques 1 AI
T1571 · Non-Standard Port
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-105790
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Microsoft UFO: Authenticated Galaxy device registration can bypass WebSocket SSRF IP pinning via redirects
Source: CVE Program / CVE List V5
Vulnerability Description
Microsoft UFO is an open-source framework for intelligent automation across devices and platforms. Prior to 3.0.9, authenticated device registration through /api/devices can supply a permitted attacker-controlled WebSocket endpoint while aip/transport/websocket.py applies pinned_addresses only to the initial destination. The pinned websockets.connect() client follows cross-origin redirects and opens a new TCP connection before Galaxy performs its post-handshake peer-IP validation, allowing WebSocket upgrade requests to internal hosts reachable from the server. The confirmed impact is the internal connection and handshake request, and does not establish arbitrary HTTP methods, response-body disclosure, a completed AIP session, or cloud metadata access. This issue is fixed in version 3.0.9.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
服务端请求伪造(SSRF)
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-105790
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-105790
请登录查看更多情报信息。
Other References for CVE-2026-105790 (3)
-
https://github.com/microsoft/UFO/releases/tag/v3.0.9 x_refsource_MISC
-
https://github.com/microsoft/UFO/security/advisories/GHSA-3pgm-xw75-hq27 x_refsource_CONFIRM
Same Patch Batch · microsoft · 2026-10-06 · 11 CVEs total
| CVE-2026-105794 | 9.1 CRITICAL | MsQuic: Improper Certificate Validation in Microsoft.Native.Quic.MsQuic.OpenSSL |
| CVE-2026-105793 | 9.1 CRITICAL | Microsoft UFO: Authenticated Android shell command injection in Mobile MCP `press_key` |
| CVE-2026-105797 | 8.8 HIGH | SimpleChat: Command injection via authorization-gate ordering flaw (arbitrary process spaw |
| CVE-2026-105796 | 8.8 HIGH | Kiota: Code injection through doc-comment delimiter reformation in Kiota Java and PHP gene |
| CVE-2026-105788 | 8.8 HIGH | Microsoft UFO: Authenticated Android shell command injection in Mobile MCP type_text and l |
| CVE-2026-105798 | 8.7 HIGH | SimpleChat: Stored XSS via group document filename in inline onclick handler |
| CVE-2026-105791 | 7.5 HIGH | Microsoft UFO: Arbitrary code execution in `run_shell` via `explorer.exe` argument injecti |
| CVE-2026-105792 | 6.5 MEDIUM | Microsoft UFO: Authenticated task-result request can deadlock UFO server session manager |
| CVE-2026-105789 | 5.4 MEDIUM | Microsoft UFO: Arbitrary file write in the Linux MCP `execute_command` tool |
| CVE-2026-105795 | 3.1 LOW | Kiota: Unsafe oauth_card_path references in Kiota-generated API plugin manifests |
IV. Related Vulnerabilities
Same product: UFO
-
CVE-2026-105793
Microsoft UFO: Authenticated Android shell command injection -
CVE-2026-105792
Microsoft UFO: Authenticated task-result request can deadloc -
CVE-2026-105791
Microsoft UFO: Arbitrary code execution in `run_shell` via ` -
CVE-2026-105789
Microsoft UFO: Arbitrary file write in the Linux MCP `execut -
CVE-2026-105788
Microsoft UFO: Authenticated Android shell command injection
Same vendor: microsoft
-
CVE-2026-105798
SimpleChat: Stored XSS via group document filename in inline -
CVE-2026-105797
SimpleChat: Command injection via authorization-gate orderin -
CVE-2026-105796
Kiota: Code injection through doc-comment delimiter reformat -
CVE-2026-105795
Kiota: Unsafe oauth_card_path references in Kiota-generated -
CVE-2026-105794
MsQuic: Improper Certificate Validation in Microsoft.Native.
Same weakness: CWE-918
-
CVE-2026-87890
Potential request forgery via spatial lookup byte values -
CVE-2026-39728
WordPress Instapage Plugin plugin <= 3.7.2 - Server Side Req -
CVE-2026-39719
WordPress PDF Smart Viewer for Elementor plugin <= 1.0.4 - S -
CVE-2026-105762
Dify: Unauthenticated Server-Side Request Forgery in /consol -
CVE-2026-103546
Improper validation of Ops Manager configuration in MongoDB
V. Comments for CVE-2026-105790
No comments yet