CVE-2026-46414 Overview
CVE-2026-46414 is an authentication weakness in Microsoft UFO, an open-source framework for intelligent automation across devices and platforms. The vulnerability affects the WebSocket control plane in version 3.0.1-4-ge2626659. The server trusts client-supplied identity and role fields contained in task messages instead of enforcing the role established when the WebSocket connection registered. Any authenticated client holding the shared server token can spoof the higher-privilege constellation role and dispatch attacker-controlled tasks to other connected devices. The flaw is tracked under [CWE-290: Authentication Bypass by Spoofing].
Critical Impact
An authenticated WebSocket client can impersonate the constellation controller, hijack peer devices, and overwrite registered clients by reusing client_id values.
Affected Products
- Microsoft UFO framework version 3.0.1-4-ge2626659
- UFO WebSocket control plane component
- Connected UFO client devices using the shared server token
Discovery Timeline
- 2026-05-27 - CVE-2026-46414 published to NVD
- 2026-05-27 - Last updated in NVD database
Technical Details for CVE-2026-46414
Vulnerability Analysis
Microsoft UFO's WebSocket server maintains a client registry that records each connection's client_id, role, and task protocol at registration time. The defect appears when the server processes subsequent TASK messages. Rather than consulting the registered role tied to the live WebSocket session, the server reads the client_type and target_id fields directly from the inbound message. A client that registered as a normal device can later send a TASK message claiming client_type="constellation" and a target_id referencing a victim device.
The server honors the wire-supplied values and routes the attacker-controlled task to the targeted peer. The same registry permits duplicate client_id registrations. A second connection using an existing client_id overwrites the stored WebSocket handle, role, and task protocol for the live client. This enables session takeover of an already connected device without disconnecting it first.
Root Cause
The root cause is missing server-side enforcement of the role bound to each WebSocket session. The control plane treats authentication with the shared token as sufficient and accepts message-level identity claims at face value. There is no comparison between the registered role and the role asserted in each task message, and no uniqueness constraint on client_id registrations.
Attack Vector
An attacker requires the shared server token used by all UFO clients. After establishing a normal WebSocket session, the attacker crafts a TASK message containing client_type="constellation" and target_id set to a victim device identifier. The server dispatches the task to the named target. Alternatively, the attacker registers a new connection using a known victim client_id to overwrite the existing registry entry and intercept subsequent task routing. Exploitation requires network access to the WebSocket endpoint and valid credentials, but no user interaction. See the GitHub Security Advisory for protocol-level details.
Detection Methods for CVE-2026-46414
Indicators of Compromise
- WebSocket clients that register with one role and later transmit TASK messages declaring client_type="constellation"
- Multiple registration events for the same client_id from differing source addresses or sessions
- Unexpected task dispatches to devices that did not originate from the legitimate constellation controller
- Sudden changes to a client's stored task protocol or role mid-session
Detection Strategies
- Log every WebSocket registration and TASK message, then alert when the message role differs from the role recorded at registration.
- Correlate client_id values across active sessions to detect duplicate or overwriting registrations.
- Baseline which client identifiers legitimately act as constellation and flag any deviation.
Monitoring Recommendations
- Forward UFO control-plane logs to a centralized SIEM for cross-session correlation.
- Monitor network flows to the WebSocket endpoint for unauthorized client sources holding the shared token.
- Track task dispatch rates per client identifier to surface peer task hijacking attempts.
How to Mitigate CVE-2026-46414
Immediate Actions Required
- Restrict network access to the UFO WebSocket endpoint to trusted operator networks only.
- Rotate the shared server token and revoke it from any host that does not require constellation privileges.
- Audit the active client registry for duplicate client_id entries and disconnect suspicious sessions.
- Apply the fix referenced in the Microsoft UFO Security Advisory GHSA-qgx6-cvhg-jw7p once available.
Patch Information
Microsoft has published the issue through GitHub Security Advisory GHSA-qgx6-cvhg-jw7p. Refer to the advisory for the fixed commit and upgrade instructions. Affected operators should upgrade past version 3.0.1-4-ge2626659 to a release that binds role enforcement to the registered WebSocket session and rejects duplicate client_id registrations.
Workarounds
- Issue per-client tokens with embedded role claims rather than a single shared server token, and validate the claim server-side on every message.
- Place a reverse proxy in front of the WebSocket endpoint that enforces source allowlisting and rate limits registration attempts.
- Disable or segment the constellation role to a dedicated control host that does not share the network with normal device clients.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
