CVE-2026-73297— Microsoft UFO: IPv6 transition address bypass of SSRF guard in URL validation
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-73297
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Microsoft UFO: IPv6 transition address bypass of SSRF guard in URL validation
Source: CVE Program / CVE List V5
Vulnerability Description
Microsoft UFO open-source framework for intelligent automation across devices and platforms. Prior to 3.0.8, _is_blocked_ip in ufo/utils/url_security.py did not block NAT64 prefixes 64:ff9b::/96 and 64:ff9b:1::/48, the 6to4 prefix 2002::/16, or the Teredo prefix 2001::/32 and did not re-check embedded IPv4 destinations, allowing an unauthenticated remote attacker who can influence URLs processed by validate_url to bypass the SSRF guard and reach cloud metadata, internal services, or localhost. This issue is fixed in version 3.0.8.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
服务端请求伪造(SSRF)
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-73297
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-73297
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-73297 (2)
- 🔗 Release v3.0.8 · microsoft/UFO · GitHubx_refsource_MISC
Vendor Advisories for CVE-2026-73297 (1)
Same Patch Batch · microsoft · 2026-08-12 · 4 CVEs total
| CVE-2026-73299 | 10.0 CRITICAL | Prompty: Server-Side Template Injection to Remote Code Execution in the @prompty/core Nunj |
| CVE-2026-73296 | 9.4 CRITICAL | Microsoft UFO: Unauthenticated Mobile MCP access allows remote Android device control and |
| CVE-2026-73298 | 8.7 HIGH | Microsoft Container Migration Solution Accelerator: Authenticated IDOR allowing read/write |
IV. Related Vulnerabilities
Same product: UFO
- CVE-2026-73296
Microsoft UFO: Unauthenticated Mobile MCP access allows remo - CVE-2026-55440
Microsoft UFO: COMMAND_RESULTS handler creates unowned sessi - CVE-2026-54568
Microsoft UFO: Missing Authorization in DEVICE_INFO_REQUEST - CVE-2026-46538
Microsoft UFO accepts cross-device TASK_END messages by sess - CVE-2026-46416
Microsoft UFO shared WebSocket handler state causes cross-cl
Same vendor: microsoft
- CVE-2026-73299
Prompty: Server-Side Template Injection to Remote Code Execu - CVE-2026-73298
Microsoft Container Migration Solution Accelerator: Authenti - CVE-2026-73296
Microsoft UFO: Unauthenticated Mobile MCP access allows remo - CVE-2026-70339
Microsoft Edge (Chromium-based) Remote Code Execution Vulner - CVE-2026-65680
Microsoft OneDrive for MacOS Elevation of Privilege Vulnerab
Same weakness: CWE-918
- CVE-2026-19770
feedmob fm-mcp-servers Download Endpoint index.ts downloadRe - CVE-2026-19765
eyaushev swagger-testcase-mcp fetch_swagger swagger-parser.t - CVE-2026-19753
Model Context Protocol mcp-rdf-explorer MCP Server server.py - CVE-2026-19752
EnzoVezzaro mcp-dominican-layer PDF Parsing index.ts parse-p - CVE-2026-72855
Budibase before 3.40.0 DNS Rebinding SSRF via OpenAPI and RE
V. Comments for CVE-2026-73297
No comments yet