microsoft UFO up to 3.0.6 COMMAND_RESULTS ufo/server/ws/handler.py get_or_create_session allocation of resources

Summaryinfo

A vulnerability described as problematic has been identified in microsoft UFO up to 3.0.6. This affects the function get_or_create_session of the file ufo/server/ws/handler.py of the component COMMAND_RESULTS Handler. Executing a manipulation can lead to allocation of resources. This vulnerability is tracked as CVE-2026-55440. The attack can be launched remotely. No exploit exists.

Detailsinfo

A vulnerability has been found in microsoft UFO up to 3.0.6 and classified as problematic. This vulnerability affects the function get_or_create_session of the file ufo/server/ws/handler.py of the component COMMAND_RESULTS Handler. The manipulation with an unknown input leads to a allocation of resources vulnerability. The CWE definition for the vulnerability is CWE-770. The product allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on the size or number of resources that can be allocated, in violation of the intended security policy for that actor. As an impact it is known to affect availability. CVE summarizes:

Microsoft UFO open-source framework for intelligent automation across devices and platforms. Prior to 3.0.7, the COMMAND_RESULTS handler in ufo/server/ws/handler.py called get_or_create_session in ufo/server/services/session_manager.py without owner_client_id, allowing an authenticated client to create an unowned attacker-chosen session_id such as constellation_task_id = f"{task_name}@{task_id}" and deny the legitimate owner or exhaust memory with phantom sessions. This issue is fixed in version 3.0.7.

The advisory is shared for download at github.com. This vulnerability was named CVE-2026-55440 since 06/16/2026. The exploitation appears to be easy. The attack can be initiated remotely. There are known technical details, but no exploit is available. The current price for an exploit might be approx. USD $0-$5k (estimation calculated on 07/16/2026). The MITRE ATT&CK project declares the attack technique as T1499.

Upgrading to version 3.0.7 eliminates this vulnerability.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Vendor

• microsoft

Name

• UFO

Version

• 3.0.0
• 3.0.1
• 3.0.2
• 3.0.3
• 3.0.4
• 3.0.5
• 3.0.6

License

• commercial

Website

• Vendor: https://www.microsoft.com/
• Product: https://github.com/microsoft/UFO/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion