CVE-2026-73296

🚨 CVE-2026-73296 - UFO-Vuln 💥 Unauthenticated Mobile MCP access can expose Android screen data and provide remote UI-control capabilities through ADB. ⚠️ Security Notice This repository is intended for authorized security research, vulnerability validation, defensive testing, and controlled...

CVE-2026-62316

Microsoft UFO open-source framework for intelligent automation across devices and platforms. Prior to 3.0.8, ufo/client/mcp/httpservers/linuxmcpserver.py binds a FastMCP streamable HTTP server to localhost:8010 but does not validate the Host, Origin, or Sec-Fetch-Site headers. An...

CVE-2026-62316 Microsoft UFO: DNS Rebinding → Unauthenticated File Read / Command Execution

Microsoft UFO open-source framework for intelligent automation across devices and platforms. Prior to 3.0.8, ufo/client/mcp/httpservers/linuxmcpserver.py binds a FastMCP streamable HTTP server to localhost:8010 but does not validate the Host, Origin, or Sec-Fetch-Site headers. An...

CVE-2026-62316 Microsoft UFO: DNS Rebinding → Unauthenticated File Read / Command Execution

Microsoft UFO open-source framework for intelligent automation across devices and platforms. Prior to 3.0.8, ufo/client/mcp/httpservers/linuxmcpserver.py binds a FastMCP streamable HTTP server to localhost:8010 but does not validate the Host, Origin, or Sec-Fetch-Site headers. An...

CVE-2026-62316

Microsoft UFO (open-source intelligent automation framework) is vulnerable to a DNS rebinding attack in versions prior to 3.0.8 . The component ufo/client/mcp/http_servers/linux_mcp_server.py binds a FastMCP streamable HTTP server to localhost:8010 without validating Host , Origin , or Sec-Fetch-...

EUVD-2026-64136

Microsoft UFO open-source framework for intelligent automation across devices and platforms. Prior to 3.0.8, ufo/client/mcp/httpservers/linuxmcpserver.py binds a FastMCP streamable HTTP server to localhost:8010 but does not validate the Host, Origin, or Sec-Fetch-Site headers. An...

CVE-2026-73296

Microsoft UFO open-source framework for intelligent automation across devices and platforms. Prior to 3.0.8, createmobiledatacollectionserver and createmobileactionserver in ufo/client/mcp/httpservers/mobilemcpserver.py exposed Streamable HTTP MCP services on TCP ports 8020 and 8021 without...

CVE-2026-73297 Microsoft UFO: IPv6 transition address bypass of SSRF guard in URL validation

Microsoft UFO open-source framework for intelligent automation across devices and platforms. Prior to 3.0.8, isblockedip in ufo/utils/urlsecurity.py did not block NAT64 prefixes 64:ff9b::/96 and 64:ff9b:1::/48, the 6to4 prefix 2002::/16, or the Teredo prefix 2001::/32 and did not re-check embedde...

CVE-2026-73297 Microsoft UFO: IPv6 transition address bypass of SSRF guard in URL validation

Microsoft UFO open-source framework for intelligent automation across devices and platforms. Prior to 3.0.8, isblockedip in ufo/utils/urlsecurity.py did not block NAT64 prefixes 64:ff9b::/96 and 64:ff9b:1::/48, the 6to4 prefix 2002::/16, or the Teredo prefix 2001::/32 and did not re-check embedde...

CVE-2026-73297

Microsoft UFO open-source framework for intelligent automation across devices and platforms. Prior to 3.0.8, isblockedip in ufo/utils/urlsecurity.py did not block NAT64 prefixes 64:ff9b::/96 and 64:ff9b:1::/48, the 6to4 prefix 2002::/16, or the Teredo prefix 2001::/32 and did not re-check embedde...

CVE-2026-73297

The CVE-2026-73297 entry concerns Microsoft UFO, an open-source framework for automation across devices and platforms. Before version 3.0.8, the function _is_blocked_ip in ufo/utils/url_security.py failed to block IPv6 NAT64 prefixes (64:ff9b::/96 and 64:ff9b:1::/48), the 6to4 prefix (2002::/16),...

EUVD-2026-57325

Microsoft UFO open-source framework for intelligent automation across devices and platforms. Prior to 3.0.8, isblockedip in ufo/utils/urlsecurity.py did not block NAT64 prefixes 64:ff9b::/96 and 64:ff9b:1::/48, the 6to4 prefix 2002::/16, or the Teredo prefix 2001::/32 and did not re-check embedde...

CVE-2026-73296 Microsoft UFO: Unauthenticated Mobile MCP access allows remote Android device control and screen disclosure

Microsoft UFO open-source framework for intelligent automation across devices and platforms. Prior to 3.0.8, createmobiledatacollectionserver and createmobileactionserver in ufo/client/mcp/httpservers/mobilemcpserver.py exposed Streamable HTTP MCP services on TCP ports 8020 and 8021 without...

CVE-2026-73296 Microsoft UFO: Unauthenticated Mobile MCP access allows remote Android device control and screen disclosure

Microsoft UFO open-source framework for intelligent automation across devices and platforms. Prior to 3.0.8, createmobiledatacollectionserver and createmobileactionserver in ufo/client/mcp/httpservers/mobilemcpserver.py exposed Streamable HTTP MCP services on TCP ports 8020 and 8021 without...

CVE-2026-73296

Microsoft UFO open-source framework for intelligent automation across devices and platforms. Prior to 3.0.8, createmobiledatacollectionserver and createmobileactionserver in ufo/client/mcp/httpservers/mobilemcpserver.py exposed Streamable HTTP MCP services on TCP ports 8020 and 8021 without...

CVE-2026-73296

The CVE concerns Microsoft UFO, an open-source framework for intelligent automation. Before 3.0.8, the functions create_mobile_data_collection_server and create_mobile_action_server in ufo/client/mcp/http_servers/mobile_mcp_server.py exposed Streamable HTTP MCP services on ports 8020/8021 without...

CVE-2026-73296 Microsoft UFO: Unauthenticated Mobile MCP access allows remote Android device control and screen disclosure

Microsoft UFO open-source framework for intelligent automation across devices and platforms. Prior to 3.0.8, createmobiledatacollectionserver and createmobileactionserver in ufo/client/mcp/httpservers/mobilemcpserver.py exposed Streamable HTTP MCP services on TCP ports 8020 and 8021 without...

PT-2026-71153

Microsoft UFO open-source framework for intelligent automation across devices and platforms. Prior to 3.0.8, is blocked ip in ufo/utils/url security.py did not block NAT64 prefixes 64:ff9b::/96 and 64:ff9b:1::/48, the 6to4 prefix 2002::/16, or the Teredo prefix 2001::/32 and did not re-check...

PT-2026-71152

Name of the Vulnerable Software and Affected Versions Microsoft UFO versions prior to 3.0.8 Description The create mobile data collection server and create mobile action server functions in ufo/client/mcp/http servers/mobile mcp server.py expose Streamable HTTP MCP services on TCP ports 8020 and...

CVE-2026-55440

The CVE-2026-55440 flaw affects the Microsoft UFO open-source framework prior to version 3.0.7. In ufo/server/ws/handler.py, the COMMAND_RESULTS handler calls get_or_create_session in ufo/server/services/session_manager.py without owner_client_id, allowing an authenticated client to create an uno...