EUVD-2026-44947Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Network WebSocket endpoint requires authenticated client (PR:L); only availability is impacted via session exhaustion, no confidentiality or integrity consequence.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
4DescriptionCVE.org
Microsoft UFO open-source framework for intelligent automation across devices and platforms. Prior to 3.0.7, the COMMAND_RESULTS handler in ufo/server/ws/handler.py called get_or_create_session in ufo/server/services/session_manager.py without owner_client_id, allowing an authenticated client to create an unowned attacker-chosen session_id such as constellation_task_id = f"{task_name}@{task_id}" and deny the legitimate owner or exhaust memory with phantom sessions. This issue is fixed in version 3.0.7.
AnalysisAI
Session-squatting and memory exhaustion in Microsoft UFO's WebSocket server allow any authenticated client to permanently deny legitimate task owners access to their sessions or flood the shared session store with phantom entries. The COMMAND_RESULTS handler in ufo/server/ws/handler.py invoked get_or_create_session with a caller-supplied session_id but omitted the owner_client_id binding, and the message type carried no role gate - meaning any authenticated peer could pre-register arbitrary session IDs before their intended owners. This issue is not in CISA KEV and no public exploit has been identified, though the fix commit's regression tests provide a near-complete exploitation blueprint.
Technical ContextAI
Microsoft UFO is an open-source multi-agent GUI automation framework built on Python, where a WebSocket server brokers task sessions between orchestrating constellation clients and device agents. Sessions are keyed on a composite identifier following the pattern task_name@task_id (e.g., constellation_task_id = f"{task_name}@{task_id}") and are tracked in a shared SessionManager (ufo/server/services/session_manager.py) that enforces ownership through an owner_client_id field. CWE-400 (Uncontrolled Resource Consumption) is the root cause classification: by calling get_or_create_session without owner_client_id, the COMMAND_RESULTS handler allowed the session store to grow without bounds and without a valid owner. Two distinct DoS primitives result: (1) session squatting - the phantom entry's missing owner causes SessionOwnershipError when the legitimate client later attempts to claim the same ID, locking it out permanently; and (2) phantom session exhaustion - sending many distinct session IDs accumulates unbounded entries in the in-process store. CPE cpe:2.3:a:microsoft:ufo:*:*:*:*:*:*:*:* covers all releases prior to 3.0.7.
RemediationAI
Upgrade to Microsoft UFO version 3.0.7, the vendor-released patch available at https://github.com/microsoft/UFO/releases/tag/3.0.7 (fix commit https://github.com/microsoft/UFO/commit/cc653bde75337ab60c320e6b7cb61b86ba6ca948). The fix changes the COMMAND_RESULTS handler to perform a lookup-only session retrieval that returns None for absent sessions rather than creating them, and enforces that only the registered result-sender may submit command results. If immediate upgrade is not feasible, restrict WebSocket server access to fully trusted, audited clients only - since the attack requires an authenticated connection, tightening client onboarding eliminates the attacker population. Additionally, monitoring for COMMAND_RESULTS messages referencing unknown or pre-existing session IDs can surface exploitation attempts; however, this is detective rather than preventive. No workaround eliminates the vulnerability in code - access restriction only narrows exposure.
Missing authentication in Microsoft UFO's mobile MCP servers lets an unauthenticated remote attacker fully control an AD
DNS rebinding against Microsoft UFO's Linux MCP server (all versions prior to 3.0.8) enables an attacker-controlled web
Server-side request forgery in Microsoft UFO's URL validation layer allows unauthenticated remote attackers to bypass th
Cross-device system_info disclosure in Microsoft UFO's WebSocket server allows any authenticated DEVICE-role client to r
Same weakness CWE-400 – Uncontrolled Resource Consumption
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today