CVE-2026-73297
Received Received - Intake

Microsoft UFO Framework SSRF Bypass via IPv6 Prefixes

Publication date: 2026-08-12

Last updated on: 2026-08-12

Assigner: GitHub, Inc.

Description
Microsoft UFO open-source framework for intelligent automation across devices and platforms. Prior to 3.0.8, _is_blocked_ip in ufo/utils/url_security.py did not block NAT64 prefixes 64:ff9b::/96 and 64:ff9b:1::/48, the 6to4 prefix 2002::/16, or the Teredo prefix 2001::/32 and did not re-check embedded IPv4 destinations, allowing an unauthenticated remote attacker who can influence URLs processed by validate_url to bypass the SSRF guard and reach cloud metadata, internal services, or localhost. This issue is fixed in version 3.0.8.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-12
Last Modified
2026-08-12
Generated
2026-09-01
AI Q&A
2026-08-12
EPSS Evaluated
2026-08-31
NVD
CVE-2026-73297
EUVD
EUVD-2026-57325

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
microsoft ufo to 3.0.8 (exc)
microsoft ufo 3.0.8

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-918 The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a Server-Side Request Forgery (SSRF) bypass in Microsoft's UFO framework affecting versions before 3.0.8. The _is_blocked_ip function in ufo/utils/url_security.py fails to block IPv6 transition addresses like NAT64, 6to4, and Teredo prefixes. Attackers can craft URLs using these prefixes to embed private IPv4 destinations, bypassing SSRF protections and accessing restricted resources such as cloud metadata, internal services, or localhost.

Detection Guidance

To detect this vulnerability, check if your UFO framework version is below 3.0.8. Inspect the _is_blocked_ip function in ufo/utils/url_security.py for missing IPv6 transition address prefixes like NAT64, 6to4, and Teredo. Test URLs using these prefixes to see if they bypass SSRF protections.

Impact Analysis

An unauthenticated remote attacker could exploit this to bypass SSRF protections and access sensitive internal services, cloud metadata (e.g., AWS/GCP/Azure IMDS), or localhost services. This could lead to unauthorized data access, service disruption, or further network compromise if the attacker gains access to internal resources.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by enabling unauthorized access to internal services or cloud metadata. SSRF flaws may lead to exposure of sensitive data, violating confidentiality requirements in both regulations. GDPR emphasizes data protection and breach notification, while HIPAA mandates safeguards for protected health information. A successful SSRF attack could result in unauthorized data access or exfiltration, triggering compliance violations.

Mitigation Strategies

Upgrade to UFO version 3.0.8 or later. Ensure the _is_blocked_ip function includes NAT64, 6to4, and Teredo prefixes in its blocked networks list. Re-check embedded IPv4 addresses within these transition formats.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-73297. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart