CVE-2026-54568 Details
Description
Microsoft UFO open-source framework for intelligent automation across devices and platforms. From 3.0.0 until 3.0.6, a client connected to the UFO WebSocket server as a DEVICE could call DEVICE_INFO_REQUEST with another device's target_id and receive that device's server-side system_info through ufo/server/ws/handler.py, because handle_device_info_request and get_device_info did not enforce the constellation-only role or object-level authorization boundary. This issue is fixed in version 3.0.6.
A cross-device information disclosure vulnerability exists in the Microsoft UFO open-source framework, specifically in versions 3.0.0 prior to 3.0.6. The issue arises when a client connected to the UFO WebSocket server as a 'DEVICE' sends a 'DEVICE_INFO_REQUEST' for another device's 'target_id'. The server responds with the requested device's 'system_info', including details like hostname, internal IP, platform, OS version, CPU and memory statistics, and any custom metadata or tags assigned by the operator. This vulnerability occurs because the server does not enforce proper authorization checks, allowing devices to access information from other devices arbitrarily.
Users can upgrade to Microsoft UFO version 3.0.7, which includes the necessary authorization checks to prevent this cross-device information disclosure. Instructions for downloading the latest version are available on the project's GitHub releases page.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 16, 2026CISA-ADP
Assessed Jul 16, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/microsoft/UFO/security/advisories/GHSA-hc27-j4p9-qm2x | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/microsoft/UFO/commit/2558da4e7dd05096aa6b489eca64efed96126713 | [email protected] | Source CodeVendor |
| https://github.com/microsoft/UFO/releases/tag/3.0.6 | [email protected] | Release NotesVendor |
| https://github.com/microsoft/UFO/security/advisories/GHSA-hc27-j4p9-qm2x | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-639 | Authorization Bypass Through User-Controlled Key | [email protected] |
| CWE-862 | Missing Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Microsoft UFO | >= 3.0.0, <= 3.0.6 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 16, 2026 | CVE Modified | CISA-ADP |
| Jul 16, 2026 | New CVE Received | [email protected] |