CVE-2026-105790

Executive Summary

CVE-2026-105790 is a server-side request forgery (SSRF) vulnerability in Microsoft UFO, an open-source framework for intelligent automation across devices and platforms. An authenticated attacker can abuse the /api/devices device registration endpoint to supply an attacker-controlled WebSocket endpoint, causing the server's pinned websockets.connect() client to follow cross-origin redirects and open TCP connections to internal hosts before post-handshake peer-IP validation occurs. The confirmed impact is limited to the internal connection and handshake request, with a CVSS 3.1 base score of 6.4, and the issue is resolved in version 3.0.9.

Technical Analysis

Microsoft UFO (version prior to 3.0.9) exposes a device registration workflow through the /api/devices API endpoint. The vulnerability is rooted in the aip/transport/websocket.py module, which implements a WebSocket client using the websockets.connect() function. This client is configured with a pinned_addresses parameter intended to constrain outbound WebSocket connections to a validated, permitted destination.

The core weakness is an application of an insufficiently strict SSRF defense (CWE-918). Although pinned_addresses is applied to the initial destination, the client follows cross-origin HTTP redirects. When a WebSocket upgrade request is redirected to a different origin, the pinned address constraint is no longer enforced on the redirected connection. As a result, the client opens a new TCP connection to the redirect target before the Galaxy component performs its post-handshake peer-IP validation.

Because the TCP connection and WebSocket upgrade request are already transmitted to the redirect target prior to validation, an attacker can cause the UFO server to issue WebSocket upgrade requests to internal hosts reachable from the server. The pinned_addresses pin is bypassed for redirects, and Galaxy's peer-IP validation occurs only after the handshake, leaving a window where the outbound request has already been sent.

The NVD description explicitly limits the confirmed impact: the vulnerability allows an internal connection and handshake request. It does not establish arbitrary HTTP method execution, response-body disclosure, a completed AIP session, or cloud metadata access. The attack requires authenticated access to the device registration API (/api/devices), which corresponds to the CVSS privilege requirement of Low (PR:L). The scope is changed (S:C) because the vulnerable component allows a connection to a different security authority (internal hosts), and confidentiality and integrity are each rated Low (C:L/I:L) given the constrained impact, while availability is None (A:N). The attack is network-reachable (AV:N), requires no user interaction (UI:N), and has low complexity (AC:L).

Exploitation Scenarios

1. Reconnaissance / target identification: The attacker identifies an accessible Microsoft UFO deployment and obtains valid credentials for the device registration functionality. No public proof-of-concept is available; the attack chain below is inferred from the SSRF vulnerability class and the mechanics described in the NVD entry.

2. Triggering the flaw: The attacker submits a device registration request to /api/devices, supplying an attacker-controlled WebSocket endpoint URL. This endpoint is designed to return an HTTP redirect (e.g., a 3xx response) that points to an internal host reachable from the UFO server. The attacker's endpoint must be permitted by the initial destination validation so that pinned_addresses accepts it.

3. Payload/execution at the vulnerability-class level: When the UFO server processes the registration, aip/transport/websocket.py calls websockets.connect() against the attacker-supplied endpoint. The client follows the cross-origin redirect and opens a new TCP connection to the internal target, sending a WebSocket upgrade request. Because Galaxy's peer-IP validation occurs only after the handshake, the request reaches the internal host before being validated or blocked.

4. Post-exploitation impact: The confirmed impact is the establishment of the internal connection and the delivery of the handshake request to an internal host. Per the NVD description, this does not extend to arbitrary HTTP methods, response-body disclosure, a completed AIP session, or cloud metadata access. The primary effect is an internal network reachability probe and potential interaction with internal WebSocket services, which may be leveraged for further reconnaissance or chained attacks depending on the internal environment.

Impact Assessment

The CVSS 3.1 base score is 6.4 (Medium), with the vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. The scope change (S:C) reflects that the vulnerable UFO server can be induced to interact with internal hosts outside its intended security boundary. Confidentiality and integrity impacts are Low; the vulnerability does not disclose response bodies or complete a full AIP session, and availability is unaffected.

Affected systems are Microsoft UFO deployments running versions prior to 3.0.9 that expose the /api/devices registration endpoint to authenticated users and run the aip/transport/websocket.py client. The blast radius is primarily the internal network segment reachable from the UFO server. Business impact includes internal network reconnaissance, potential exposure of internal WebSocket services to handshake requests, and possible use as a pivot point in multi-stage attacks. Because exploitation requires authentication, the practical risk depends on the attacker's ability to obtain low-privileged credentials or register as a device.

Detection Guidance

Sigma Rule

title: Microsoft UFO SSRF via Device Registration Redirect
id: 3f9a1c2e-7d4b-4a6e-9b1c-0e5f2a7d8c91
status: experimental
description: Detects authenticated device registration to /api/devices followed by outbound WebSocket connections to internal hosts, indicative of CVE-2026-105790 SSRF exploitation.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-105790
author: valtersit.com Threat Intelligence
date: 2026/01/01
tags:
  - attack.t1190
  - attack.t1090
logsource:
  category: webserver
  product: windows
detection:
  selection_api:
    cs-method: 'POST'
    cs-uri-stem|contains: '/api/devices'
  selection_status:
    sc-status:
      - 200
      - 201
  condition: selection_api and selection_status
falsepositives:
  - Legitimate device registration by authorized administrators
level: medium

YARA Rule

rule CVE_2026_105790_UFO_SSRF_Redirect
{
    meta:
        description = "Detects Microsoft UFO WebSocket transport code referencing pinned_addresses and cross-origin redirect handling related to CVE-2026-105790"
        author = "valtersit.com Threat Intelligence"
        date = "2026-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-105790"
        severity = "medium"
    strings:
        $p1 = "pinned_addresses" ascii
        $p2 = "websockets.connect" ascii
        $p3 = "aip/transport/websocket" ascii
        $p4 = "Galaxy" ascii
    condition:
        uint32(0) == 0x04034b50 or
        (2 of ($p*) and filesize < 10MB)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-105790 Microsoft UFO SSRF Device Registration Redirect Attempt"; flow:to_server,established; http.method; content:"POST"; http.uri; content:"/api/devices"; http.response_status; content:"30"; reference:cve,2026-105790; classtype:attempted-recon; sid:2026105790; rev:1;)

Elastic Detection

sequence by host.id, user.name with maxspan=5m
  [ network where process.name in ("python", "python3") and
      destination.port in (80, 443, 8080, 8443) and
      network.direction == "egress" and
      url.path like "*/api/devices" ]
  [ network where process.name in ("python", "python3") and
      destination.ip != null and
      network.direction == "egress" and
      destination.port in (80, 443, 8080, 8443) ]

Splunk SPL Query

index=web OR index=proxy
| search ("/api/devices" AND method=POST)
| stats count by src_ip, dest_ip, uri_path, status, user
| where count > 0 AND status IN (200, 201, 301, 302, 307, 308)
| table _time, src_ip, dest_ip, uri_path, status, user
| sort - _time

Wazuh OSSEC Rule

<group name="microsoft_ufo,cve_2026_105790,">
  <rule id="100790" level="10">
    <decoded_as>json</decoded_as>
    <field name="http.url">/api/devices</field>
    <field name="http.method">POST</field>
    <description>CVE-2026-105790: Microsoft UFO device registration attempt to /api/devices - possible SSRF via WebSocket redirect</description>
    <mitre>
      <id>T1190</id>
      <id>T1090</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations:

   • Restrict network egress from the UFO server to only explicitly required external destinations. Deny outbound connections to internal RFC1918 ranges, loopback, and link-local addresses.
   • Limit access to the /api/devices device registration endpoint to trusted, authenticated administrators only. Audit and monitor all registration attempts.
   • Deploy the provided detection rules to identify requests to /api/devices followed by outbound WebSocket connections to internal IP addresses.

2. Patch/upgrade steps:

   • Upgrade Microsoft UFO to version 3.0.9 or later, where the issue is fixed. The fix should be treated as the authoritative remediation even though no vendor patch evidence has been tracked in public sources as of this report.
   • Verify the deployed version and the behavior of aip/transport/websocket.py after upgrading.

3. Long-term hardening:

   • Implement strict redirect handling in WebSocket clients, including disallowing or re-validating cross-origin redirects against the pinned_addresses allowlist.
   • Perform peer-IP validation before establishing a TCP connection rather than post-handshake in the Galaxy component.
   • Adopt a defense-in-depth SSRF mitigation strategy: allowlist-based egress filtering, DNS rebinding protections, and network segmentation.

References

• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-105790
• CWE-918 (Server-Side Request Forgery): https://cwe.mitre.org/data/definitions/918.html
• Microsoft UFO project (open-source framework): https://github.com/microsoft/UFO
• FIRST EPSS: Not yet scored at time of writing
• CISA KEV Catalog: CVE-2026-105790 is not listed. No public proof-of-concept, exploit code, Nuclei template, or known threat actor campaign evidence is currently available.