CVE-2026-46538

{
  "id": "CVE-2026-46538",
  "sourceIdentifier": "[email protected]",
  "published": "2026-05-27T23:16:48.107",
  "lastModified": "2026-10-26T12:10:00.130",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Microsoft UFO open-source framework for intelligent automation across devices and platforms. In 3.0.1-4-ge2626659, Microsoft UFO's constellation client tracks pending task responses by session_id only and does not verify that a TASK_END message came from the device that originally received the task. When the constellation sends a task to a target device, it records a pending Future under a session key. The pending task record stores the expected device ID, but the completion path ignores that binding. If another authenticated peer device sends a forged TASK_END with the same session_id, the constellation accepts the response and completes the victim device's pending Future with attacker-controlled result data. This is an authenticated cross-device task-result injection issue."
    },
    {
      "lang": "es",
      "value": "Microsoft UFO, framework de código abierto para automatización inteligente en todos los dispositivos y plataformas. En la versión 3.0.1-4-ge2626659, el cliente constellation de Microsoft UFO rastrea las respuestas de tareas pendientes solo por session_id y no verifica que un mensaje TASK_END provenga del dispositivo que recibió la tarea originalmente. Cuando constellation envía una tarea a un dispositivo objetivo, registra un Future pendiente bajo una clave de sesión. El registro de la tarea pendiente almacena el ID de dispositivo esperado, pero la ruta de finalización ignora esa vinculación. Si otro dispositivo par autenticado envía un TASK_END falsificado con el mismo session_id, constellation acepta la respuesta y completa el Future pendiente del dispositivo víctima con datos de resultado controlados por el atacante. Esto es un problema de inyección de resultados de tareas entre dispositivos autenticado."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "microsoft",
          "product": "UFO",
          "versions": [
            {
              "version": "3.0.1-4-ge2626659",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:L",
          "baseScore": 5.9,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "HIGH",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "NONE",
          "integrityImpact": "HIGH",
          "availabilityImpact": "LOW"
        },
        "exploitabilityScore": 1.6,
        "impactScore": 4.2
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-05-28T12:37:58.013066Z",
          "id": "CVE-2026-46538",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-294"
        },
        {
          "lang": "en",
          "value": "CWE-345"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/microsoft/UFO/security/advisories/GHSA-wmq2-74rj-7pjc",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/microsoft/UFO/security/advisories/GHSA-wmq2-74rj-7pjc",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
    }
  ]
}