CVE-2026-73297: Microsoft UFO: IPv6 transition address bypass of SSRF guard in URL validation
Microsoft UFO open-source framework for intelligent automation across devices and platforms. Prior to 3.0.8, isblockedip in ufo/utils/urlsecurity.py did not block NAT64 prefixes 64:ff9b::/96 and 64:ff9b:1::/48, the 6to4 prefix 2002::/16, or the Teredo prefix 2001::/32 and did not re-check embedded IPv4 destinations, allowing an unauthenticated remote attacker who can influence URLs processed by validateurl to bypass the SSRF guard and reach cloud metadata, internal services, or localhost. This issue is fixed in version 3.0.8.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Microsoft UFO (ufo/utils/url_security.py)to a version that resolves this vulnerability.Fixed in 3.0.8
Event History
Frequently Asked Questions
What is the severity of CVE-2026-73297?
CVE-2026-73297 has a risk rating of 71, indicating a high severity level.
How do I fix CVE-2026-73297?
To fix CVE-2026-73297, update Microsoft UFO to version 3.0.8 or later.
What does CVE-2026-73297 affect?
CVE-2026-73297 affects the Microsoft UFO open-source framework prior to version 3.0.8.
What type of vulnerability is CVE-2026-73297?
CVE-2026-73297 is classified as a Server-Side Request Forgery (SSRF) vulnerability.
Why is the issue in CVE-2026-73297 significant?
The issue in CVE-2026-73297 is significant because it allows bypassing of the SSRF guard in URL validation for certain IPv6 transition addresses.