CVE-2026-55440 Details
Description
Microsoft UFO open-source framework for intelligent automation across devices and platforms. Prior to 3.0.7, the COMMAND_RESULTS handler in ufo/server/ws/handler.py called get_or_create_session in ufo/server/services/session_manager.py without owner_client_id, allowing an authenticated client to create an unowned attacker-chosen session_id such as constellation_task_id = f"{task_name}@{task_id}" and deny the legitimate owner or exhaust memory with phantom sessions. This issue is fixed in version 3.0.7.
A vulnerability in the Microsoft UFO open-source framework, prior to version 3.0.7, allows authenticated clients to create unowned sessions through the WebSocket command results handler. This is achieved by injecting a custom session ID, which can disrupt the session management of legitimate users. The flaw arises because the command results handler does not properly verify session ownership, enabling a form of denial-of-service by denying access to legitimate session owners and causing resource exhaustion with phantom sessions.
Users should update to Microsoft UFO version 3.0.7 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 16, 2026CISA-ADP
Assessed Jul 16, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/microsoft/UFO/security/advisories/GHSA-hxjv-fmjf-wmjf | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/microsoft/UFO/commit/cc653bde75337ab60c320e6b7cb61b86ba6ca948 | [email protected] | Source CodeVendor |
| https://github.com/microsoft/UFO/releases/tag/3.0.7 | [email protected] | Release NotesVendor |
| https://github.com/microsoft/UFO/security/advisories/GHSA-hxjv-fmjf-wmjf | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-400 | Uncontrolled Resource Consumption | [email protected] |
| CWE-862 | Missing Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Microsoft UFO | <= 3.0.1 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 16, 2026 | CVE Modified | CISA-ADP |
| Jul 16, 2026 | New CVE Received | [email protected] |