CVE-2026-46544 Details
Description
Microsoft UFO open-source framework for intelligent automation across devices and platforms. In 3.0.1-4-ge2626659, Microsoft UFO accepts client-supplied session_id values in WebSocket task messages and reuses an existing in-memory session object if that session_id already exists. If a prior session has completed and remains in memory with populated results, a different authenticated client can send a new TASK message using the same session_id. The server re-enters the existing session object and sends the stale stored result to the new requester through the normal send_task_end() callback path. This is an authenticated cross-client stale result replay issue. The issue requires that the attacker knows or can predict a live or recently completed session_id.
A vulnerability in the Microsoft UFO framework versions 3.0.1-4-ge2626659 allows authenticated WebSocket clients to reuse session IDs provided by the client. The server accepts these session IDs in task messages and, if the session ID corresponds to an existing in-memory session object, it reuses that session without any ownership or client binding checks. This flaw enables the replay of stale task results to different authenticated clients, potentially disclosing workflow data, screenshots, and other device-derived task results. The issue arises because completed sessions remain in memory, and some session IDs can be easily predicted or derived from task identifiers.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed May 27, 2026CISA-ADP
Assessed May 28, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/microsoft/UFO/security/advisories/GHSA-29gc-vqjp-7fqf | CISA-ADP | AdvisoryExploitTechnical AnalysisVendor |
| https://github.com/microsoft/UFO/security/advisories/GHSA-29gc-vqjp-7fqf | [email protected] | AdvisoryExploitTechnical AnalysisVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-639 | Authorization Bypass Through User-Controlled Key | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Microsoft UFO | v3.0.1-4-ge2626659 (semver) |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 28, 2026 | CVE Modified | CISA-ADP |
| May 27, 2026 | New CVE Received | [email protected] |