# CVE-2026-105790: Microsoft UFO WebSocket SSRF IP pinning bypass in device registration

Source: https://junglewise.ai/threats/cve-2026-105790-microsoft-ufo-is-an-open-source-framework-for-intelligent  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-06. Updated: 2026-10-06  
License: CC BY 4.0 with a link back

CVE-2026-105790 · Severity: medium · CVSS 6.4 · Published 2026-10-06

Microsoft UFO is an open-source framework for intelligent automation that uses WebSocket endpoints to connect devices. An authenticated attacker can register a malicious WebSocket endpoint that bypasses the framework's IP address filtering by exploiting redirect handling, allowing them to open connections to internal hosts on the server's network that would normally be blocked.

Technologies: [Microsoft UFO](https://junglewise.ai/threats/technologies/ufo). Vendors: [Microsoft](https://junglewise.ai/threats/vendors/microsoft).

## Quick answers

**Is CVE-2026-105790 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-105790 being exploited in the wild.

**How severe is CVE-2026-105790?** Medium severity, with a CVSS score of 6.4, published 6 October 2026.

**Which products and versions are affected?** Microsoft UFO before 3.0.9.

**Is there a fix for CVE-2026-105790?** Yes: fixed in 3.0.9. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-105790 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-105790?** Check whether you run Microsoft UFO at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 3.0.9

## Technical details

The vulnerability is a server-side request forgery (SSRF) affecting the /api/devices endpoint in aip/transport/websocket.py. An authenticated attacker can supply an attacker-controlled WebSocket endpoint that triggers a redirect; the websockets.connect() client follows the redirect and opens a TCP connection to an internal host before post-handshake peer-IP validation occurs, bypassing the pinned_addresses restriction on the initial destination. The attack requires authentication and network access to the API endpoint.

## Affected products

- Microsoft UFO before 3.0.9

## Timeline

- 2026-10-06: disclosed
- 2026-09-14: patched

## References

- [https://github.com/microsoft/UFO/commit/f31fb5ef7d07b7825a03fe34b88f1f21cb5cfd35](https://github.com/microsoft/UFO/commit/f31fb5ef7d07b7825a03fe34b88f1f21cb5cfd35)
- [https://github.com/microsoft/UFO/releases/tag/v3.0.9](https://github.com/microsoft/UFO/releases/tag/v3.0.9)

## Related threats

- [Microsoft UFO command injection in Mobile MCP press_key](https://junglewise.ai/threats/cve-2026-105793-microsoft-ufo-is-an-open-source-framework-for-intelligent)
- [Microsoft UFO deadlock in task result endpoint](https://junglewise.ai/threats/cve-2026-105792-microsoft-ufo-is-an-open-source-framework-for-intelligent)
- [Microsoft UFO command injection in run_shell via explorer.exe](https://junglewise.ai/threats/cve-2026-105791-microsoft-ufo-is-an-open-source-framework-for-intelligent)
- [Microsoft UFO command allowlist bypass in Linux MCP server](https://junglewise.ai/threats/cve-2026-105789-microsoft-ufo-is-an-open-source-framework-for-intelligent)
- [Microsoft UFO authenticated Android shell command injection in Mobile MCP](https://junglewise.ai/threats/cve-2026-105788-microsoft-ufo-is-an-open-source-framework-for-intelligent)