CVE-2026-105790

Name of the Vulnerable Software and Affected Versions Microsoft UFO versions prior to 3.0.9

Description Authenticated device registration via the '/api/devices' endpoint allows an attacker to provide a controlled WebSocket endpoint. The aip/transport/websocket.py component applies pinned addresses only to the initial destination. Because the websockets.connect() client follows cross-origin redirects and opens a new TCP connection before the post-handshake peer-IP validation is performed, WebSocket upgrade requests can be sent to internal hosts reachable from the server. The impact is limited to the internal connection and handshake request, without allowing arbitrary HTTP methods, response-body disclosure, completed AIP sessions, or cloud metadata access.

Recommendations Update to version 3.0.9.