Microsoft UFO 3.0.1-4-ge2626659 TASK Message authentication spoofing

Summaryinfo

A vulnerability classified as critical has been found in Microsoft UFO 3.0.1-4-ge2626659. Impacted is an unknown function of the component TASK Message Handler. This manipulation causes authentication spoofing. This vulnerability is tracked as CVE-2026-46414. The attack is possible to be carried out remotely. No exploit exists.

Detailsinfo

A vulnerability has been found in Microsoft UFO 3.0.1-4-ge2626659 and classified as critical. Affected by this vulnerability is some unknown processing of the component TASK Message Handler. The manipulation with an unknown input leads to a authentication spoofing vulnerability. The CWE definition for the vulnerability is CWE-290. This attack-focused weakness is caused by incorrectly implemented authentication schemes that are subject to spoofing attacks. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

Microsoft UFO open-source framework for intelligent automation across devices and platforms. In 3.0.1-4-ge2626659, Microsoft UFO's WebSocket control plane trusts client-supplied identity and role fields in task messages. A client connection can register as a normal device, but later send a TASK message claiming client_type="constellation" and target_id=. The server trusts the role and target values from the wire message rather than enforcing the role registered for that WebSocket connection. As a result, any authenticated WebSocket client with the shared server token can spoof the higher-privilege constellation role and dispatch attacker-controlled tasks to another connected device. The same client registry also allows duplicate client_id registration, overwriting an existing live client's stored websocket, role, and task protocol. This is an authenticated WebSocket role/identity spoofing issue leading to peer task hijacking.

It is possible to read the advisory at github.com. This vulnerability is known as CVE-2026-46414 since 05/13/2026. The exploitation appears to be easy. The attack can be launched remotely. The technical details are unknown and an exploit is not publicly available. The pricing for an exploit might be around USD $5k-$25k at the moment (estimation calculated on 05/28/2026).

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Vendor

• Microsoft

Name

• UFO

Version

• 3.0.1-4-ge2626659

License

• commercial

Website

• Vendor: https://www.microsoft.com/
• Product: https://github.com/microsoft/UFO/

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion