CVE-2026-46414
Microsoft UFO WebSocket Role Spoofing Vulnerability
Publication date: 2026-05-27
Last updated on: 2026-05-27
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| microsoft | ufo | 3.0.1 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-862 | The product does not perform an authorization check when an actor attempts to access a resource or perform an action. |
| CWE-290 | This attack-focused weakness is caused by incorrectly implemented authentication schemes that are subject to spoofing attacks. |
| CWE-639 | The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the Microsoft UFO open-source framework for intelligent automation. Specifically, in version 3.0.1-4-ge2626659, the WebSocket control plane trusts client-supplied identity and role fields in task messages without proper verification.
An authenticated WebSocket client can initially register as a normal device but later send a task message claiming a higher-privilege role ("constellation") and specify a target device ID. The server incorrectly trusts these role and target values from the message instead of enforcing the role assigned during connection registration.
As a result, an attacker with the shared server token can spoof a higher-privilege role and dispatch malicious tasks to other connected devices. Additionally, the client registry allows duplicate client_id registration, which can overwrite an existing live client's stored websocket, role, and task protocol, leading to peer task hijacking.
How can this vulnerability impact me? :
This vulnerability can have severe impacts including unauthorized task execution on connected devices by an attacker who spoofs a higher-privilege role.
An attacker can hijack peer tasks, potentially disrupting device operations, compromising device integrity, and causing denial of service or unauthorized actions.
Because the attacker must be an authenticated WebSocket client with the shared server token, the vulnerability allows privilege escalation and control over other devices within the system.