CVE-2026-46416

Full vulnerability record from the local CVENow database.

Description

Microsoft UFO open-source framework for intelligent automation across devices and platforms. In 3.0.1-4-ge2626659, Microsoft UFO creates one shared UFOWebSocketHandler instance and reuses it for multiple authenticated WebSocket connections. The handler stores per-connection protocol objects in mutable instance fields. Each new WebSocket connection overwrites those fields. Later, message handlers send responses through the shared fields instead of through protocol objects bound to the originating connection. As a result, the most recently connected authenticated client can receive protocol responses that belong to another authenticated client.

Severity

MEDIUM

CVSS score

6.3 (v3.1)

Vulnerability status

Deferred

Source identifier

[email protected]

Published

2026-05-27 23:16:47.973000

Last modified

2026-10-26 12:10:00.130000

View original CVE JSON

{
  "id": "CVE-2026-46416",
  "sourceIdentifier": "[email protected]",
  "published": "2026-05-27T23:16:47.973",
  "lastModified": "2026-10-26T12:10:00.130",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Microsoft UFO open-source framework for intelligent automation across devices and platforms. In 3.0.1-4-ge2626659, Microsoft UFO creates one shared UFOWebSocketHandler instance and reuses it for multiple authenticated WebSocket connections. The handler stores per-connection protocol objects in mutable instance fields. Each new WebSocket connection overwrites those fields. Later, message handlers send responses through the shared fields instead of through protocol objects bound to the originating connection. As a result, the most recently connected authenticated client can receive protocol responses that belong to another authenticated client."
    },
    {
      "lang": "es",
      "value": "Microsoft UFO, un framework de código abierto para la automatización inteligente en todos los dispositivos y plataformas. En 3.0.1-4-ge2626659, Microsoft UFO crea una instancia compartida de UFOWebSocketHandler y la reutiliza para múltiples conexiones WebSocket autenticadas. El gestor almacena objetos de protocolo por conexión en campos de instancia mutables. Cada nueva conexión WebSocket sobrescribe esos campos. Más tarde, los gestores de mensajes envían respuestas a través de los campos compartidos en lugar de a través de objetos de protocolo vinculados a la conexión de origen. Como resultado, el cliente autenticado conectado más recientemente puede recibir respuestas de protocolo que pertenecen a otro cliente autenticado."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "microsoft",
          "product": "UFO",
          "versions": [
            {
              "version": "3.0.1-4-ge2626659",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
          "baseScore": 6.3,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "availabilityImpact": "LOW"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 3.4
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-05-28T13:01:31.239546Z",
          "id": "CVE-2026-46416",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-284"
        },
        {
          "lang": "en",
          "value": "CWE-488"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/microsoft/UFO/security/advisories/GHSA-cwwh-p9rv-4pj4",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/microsoft/UFO/security/advisories/GHSA-cwwh-p9rv-4pj4",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
    }
  ]
}