microsoft UFO up to 3.0.5 WebSocket ufo/server/ws/handler.py handle_device_info_request improper authorization

Summaryinfo

A vulnerability marked as problematic has been reported in microsoft UFO up to 3.0.5. The impacted element is the function handle_device_info_request of the file ufo/server/ws/handler.py of the component WebSocket Handler. Performing a manipulation results in improper authorization. This vulnerability is identified as CVE-2026-54568. The attack can be initiated remotely. There is not any exploit available.

Detailsinfo

A vulnerability, which was classified as problematic, was found in microsoft UFO up to 3.0.5. This affects the function handle_device_info_request of the file ufo/server/ws/handler.py of the component WebSocket Handler. The manipulation with an unknown input leads to a improper authorization vulnerability. CWE is classifying the issue as CWE-285. The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action. This is going to have an impact on confidentiality. The summary by CVE is:

Microsoft UFO open-source framework for intelligent automation across devices and platforms. From 3.0.0 until 3.0.6, a client connected to the UFO WebSocket server as a DEVICE could call DEVICE_INFO_REQUEST with another device's target_id and receive that device's server-side system_info through ufo/server/ws/handler.py, because handle_device_info_request and get_device_info did not enforce the constellation-only role or object-level authorization boundary. This issue is fixed in version 3.0.6.

It is possible to read the advisory at github.com. This vulnerability is uniquely identified as CVE-2026-54568 since 06/15/2026. The exploitability is told to be easy. It is possible to initiate the attack remotely. Technical details of the vulnerability are known, but there is no available exploit. The pricing for an exploit might be around USD $0-$5k at the moment (estimation calculated on 07/16/2026). The attack technique deployed by this issue is T1548.002 according to MITRE ATT&CK.

Upgrading to version 3.0.6 eliminates this vulnerability.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Vendor

• microsoft

Name

• UFO

Version

• 3.0.0
• 3.0.1
• 3.0.2
• 3.0.3
• 3.0.4
• 3.0.5

License

• commercial

Website

• Vendor: https://www.microsoft.com/
• Product: https://github.com/microsoft/UFO/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion