CVE-2026-46414

Microsoft UFO open-source framework for intelligent automation across devices and platforms. In 3.0.1-4-ge2626659, Microsoft UFO's WebSocket control plane trusts client-supplied identity and role fields in task messages. A client connection can register as a normal device, but later send a TASK message claiming client_type="constellation" and target_id=<victim-device-id>. The server trusts the role and target values from the wire message rather than enforcing the role registered for that WebSocket connection. As a result, any authenticated WebSocket client with the shared server token can spoof the higher-privilege constellation role and dispatch attacker-controlled tasks to another connected device. The same client registry also allows duplicate client_id registration, overwriting an existing live client's stored websocket, role, and task protocol. This is an authenticated WebSocket role/identity spoofing issue leading to peer task hijacking.

• CWE-290
• CWE-639
• CWE-862

• https://github.com/microsoft/UFO/security/advisories/GHSA-qgx6-cvhg-jw7p
• https://github.com/microsoft/UFO/security/advisories/GHSA-qgx6-cvhg-jw7p

Published

May 27, 2026

Last Modified

Jun 17, 2026

Status

Deferred

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Same Subject, Wrong User: A Cross-Issuer Account Takeover in n8nStrix found an identity-binding bug in n8n's token-exchange flow enabling account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-46408Vvveb is a powerful and easy to use CMS with page builder to…7.6
• CVE-2026-46409OpenYak is a local-first agent runtime for reliable tool-usi…9.6
• CVE-2026-46410FileBrowser Quantum is a free, self-hosted, web-based file m…8.7
• CVE-2026-46411FlashMQ is a MQTT broker/server, designed for multi-CPU envi…6.5
• CVE-2026-46412@beproduct/nestjs-auth is a NestJS authentication module for…10
• CVE-2026-46413Discourse is an open-source discussion platform. Prior to 20…6.5
• CVE-2026-46415The Caddy Defender plugin is a middleware for Caddy that all…8.2
• CVE-2026-46416Microsoft UFO open-source framework for intelligent automati…6.3
• CVE-2026-46417Angular is a development platform for building mobile and de…6.1
• CVE-2026-46419Yubico webauthn-server-core (aka java-webauthn-server) 2.8.0…7.5
• CVE-2026-46420setup-php is a GitHub action to set up PHP with extensions, …5.6
• CVE-2026-46421The SAP Cloud Application Programming Model is a tool for bu…9.3