Microsoft UFO up to 3.0.8 Session Manager session_manager.py SessionManager.get_result_by_task behavioral workflow

Summaryinfo

A vulnerability classified as problematic has been found in Microsoft UFO up to 3.0.8. This affects the function SessionManager.get_result_by_task of the file ufo/server/services/session_manager.py of the component Session Manager. This manipulation causes behavioral workflow. This vulnerability is handled as CVE-2026-105792. The attack can be initiated remotely. There is not any exploit available. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability has been found in Microsoft UFO up to 3.0.8 and classified as problematic. Affected by this vulnerability is the function SessionManager.get_result_by_task of the file ufo/server/services/session_manager.py of the component Session Manager. The manipulation with an unknown input leads to a behavioral workflow vulnerability. The CWE definition for the vulnerability is CWE-841. The product supports a session in which more than one behavior must be performed by an actor, but it does not properly ensure that the actor performs the behaviors in the required sequence. As an impact it is known to affect availability. The summary by CVE is:

Microsoft UFO is an open-source framework for intelligent automation across devices and platforms. Prior to 3.0.9, the /api/task_result/{task_name} endpoint calls SessionManager.get_result_by_task() in ufo/server/services/session_manager.py, which acquires a non-reentrant lock and then calls SessionManager.get_result() to acquire the same lock again when the task name maps to a session. An authenticated caller who knows or creates a mapped task name can therefore block the request indefinitely, and in the default single-process server configuration the blocked event-loop thread prevents other HTTP, WebSocket, and dependent background interactions. Unknown task names do not reach the nested call and are not affected. This issue is fixed in version 3.0.9.

The advisory is shared at github.com. This vulnerability is known as CVE-2026-105792 since 10/05/2026. The exploitation appears to be easy. The attack can be launched remotely. Technical details are known, but no exploit is available. The price for an exploit might be around USD $0-$5k at the moment (estimation calculated on 10/06/2026).

Upgrading to version 3.0.9 eliminates this vulnerability.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Vendor

• Microsoft

Name

• UFO

Version

• 3.0.0
• 3.0.1
• 3.0.2
• 3.0.3
• 3.0.4
• 3.0.5
• 3.0.6
• 3.0.7
• 3.0.8

License

• commercial

Website

• Vendor: https://www.microsoft.com/
• Product: https://github.com/microsoft/UFO/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion