CVE-2026-54568 - Microsoft UFO: Missing Authorization in DEVICE_INFO_REQUEST Allows a DEVICE Client to Read Another Device's system_info

CVE ID :CVE-2026-54568 Published : July 16, 2026, 3:32 p. m. | 45 minutes ago Description :Microsoft UFO open-source framework for intelligent automation across devices and platforms.

From 3. 0. 0 until 3.

0. 6, a client connected to the UFO WebSocket server as a DEVICE could call DEVICE_INFO_REQUEST with another device's target_id and receive that device's server-side system_info through ufo/server/ws/handler.