CVE-2026-46544 microsoft CVE debrief

Who should care

Organizations running Microsoft UFO automation framework instances, particularly those exposing WebSocket endpoints to multiple authenticated clients or operating in multi-tenant configurations. Security teams responsible for open-source supply chain risk management and developers integrating UFO into automation pipelines.

Technical summary

The Microsoft UFO framework's WebSocket server implementation fails to properly isolate session state between authenticated clients. When a TASK message is received, the server extracts the session_id provided by the client and checks for an existing session object in memory. If found, the server reuses this session object regardless of whether the requesting client matches the original session owner. This design allows a second authenticated client to retrieve results from a completed session by supplying the same session_id. The vulnerability is contingent on the attacker obtaining knowledge of a valid session_id, which may be achievable through prediction, observation, or other means given the client-supplied nature of the identifier. The attack complexity is rated as high due to these prerequisites.

Defensive priority

medium

Recommended defensive actions

• Upgrade Microsoft UFO to a version newer than 3.0.1-4-ge2626659 that properly validates or regenerates session identifiers to prevent cross-client session reuse.
• Implement server-side session_id generation rather than accepting client-supplied values for session identification.
• Configure session object lifecycle management to ensure completed sessions are promptly cleared from memory and cannot be re-entered by subsequent requests.
• Monitor WebSocket task message patterns for anomalous session_id reuse attempts that may indicate exploitation attempts.
• Review authentication boundaries to ensure that session results are strictly bound to the original authenticated client and not transferable across different client contexts.

Evidence notes

The vulnerability description is sourced from the official CVE record and NVD entry. The affected product is Microsoft UFO, an open-source automation framework. The specific affected version is 3.0.1-4-ge2626659. The CVSS 3.1 vector is AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N, indicating network attack vector, high attack complexity, low privileges required, no user interaction, unchanged scope, high confidentiality impact, and no integrity or availability impact. The weakness is classified as CWE-639: Authorization Bypass Through User-Controlled Key.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.