CVE-2026-54568
Received Received - Intake

Microsoft UFO Framework Information Disclosure

Publication date: 2026-07-16

Last updated on: 2026-07-16

Assigner: GitHub, Inc.

Description
Microsoft UFO open-source framework for intelligent automation across devices and platforms. From 3.0.0 until 3.0.6, a client connected to the UFO WebSocket server as a DEVICE could call DEVICE_INFO_REQUEST with another device's target_id and receive that device's server-side system_info through ufo/server/ws/handler.py, because handle_device_info_request and get_device_info did not enforce the constellation-only role or object-level authorization boundary. This issue is fixed in version 3.0.6.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-16
Last Modified
2026-07-16
Generated
2026-07-16
AI Q&A
2026-07-16
EPSS Evaluated
N/A
NVD
CVE-2026-54568
EUVD
EUVD-2026-44943

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
microsoft ufo From 3.0.0 (inc)
microsoft ufo to 3.0.6 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Microsoft UFO framework allows a DEVICE client to request and receive another device's system information without proper authorization. The issue occurs when a client sends a DEVICE_INFO_REQUEST with a target device's ID, bypassing role-based access controls intended only for constellation/orchestrator clients. The system fails to enforce object-level authorization, enabling unauthorized access to sensitive details like hostname, IP, OS version, CPU, memory, and metadata.

Detection Guidance

To detect this vulnerability, monitor WebSocket traffic for DEVICE_INFO_REQUEST messages containing other device IDs. Check logs for unauthorized system_info requests in ufo/server/ws/handler.py. Verify if any DEVICE clients are sending requests with target_id values not assigned to them.

Impact Analysis

An attacker could exploit this to gather reconnaissance data about your system, such as internal IP addresses, OS versions, and hardware specs. This information could be used to plan further attacks, like targeting specific vulnerabilities in your environment. The attack requires knowing the victim's device ID but does not need spoofing or race conditions.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive system information, potentially violating data protection requirements under GDPR or HIPAA. GDPR mandates strict access controls for personal data, while HIPAA requires safeguards for protected health information. Unauthorized disclosure of system details may constitute a compliance breach.

Mitigation Strategies

Upgrade to UFO version 3.0.6 or later which includes authorization checks. If upgrading is not possible, restrict DEVICE client access to the WebSocket server or disable DEVICE_INFO_REQUEST functionality entirely until patched.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-54568. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart