CVE-2026-46416
Last modified
CVE-2026-46416 is a medium-severity vulnerability rated 6.3/10 on the CVSS scale. Microsoft UFO open-source framework for intelligent automation across devices and platforms. In 3.0.1-4-ge2626659, Microsoft UFO creates one shared UFOWebSocketHandler instance and reuses it for multiple authenticated WebSocket connections. EPSS estimates a 0.28% chance of exploitation in the next 30 days.
Description
Microsoft UFO open-source framework for intelligent automation across devices and platforms. In 3.0.1-4-ge2626659, Microsoft UFO creates one shared UFOWebSocketHandler instance and reuses it for multiple authenticated WebSocket connections. The handler stores per-connection protocol objects in mutable instance fields. Each new WebSocket connection overwrites those fields. Later, message handlers send responses through the shared fields instead of through protocol objects bound to the originating connection. As a result, the most recently connected authenticated client can receive protocol responses that belong to another authenticated client.
Metrics
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Weakness Enumeration
References
Timeline
- Published
- Last Modified
- Status
- Deferred
Frequently Asked Questions
What is CVE-2026-46416?
How severe is CVE-2026-46416?
How do I fix CVE-2026-46416?
How Strix Helps
- Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-46410FileBrowser Quantum is a free, self-hosted, web-based file m…8.7
- CVE-2026-46411FlashMQ is a MQTT broker/server, designed for multi-CPU envi…6.5
- CVE-2026-46412@beproduct/nestjs-auth is a NestJS authentication module for…10
- CVE-2026-46413Discourse is an open-source discussion platform. Prior to 20…6.5
- CVE-2026-46414Microsoft UFO open-source framework for intelligent automati…8.8
- CVE-2026-46415The Caddy Defender plugin is a middleware for Caddy that all…8.2
- CVE-2026-46417Angular is a development platform for building mobile and de…6.1
- CVE-2026-46419Yubico webauthn-server-core (aka java-webauthn-server) 2.8.0…7.5
- CVE-2026-46420setup-php is a GitHub action to set up PHP with extensions, …5.6
- CVE-2026-46421The SAP Cloud Application Programming Model is a tool for bu…9.3
- CVE-2026-46423Rocket.Chat is an open-source, secure, fully customizable co…9.3
- CVE-2026-46424Budibase is an open-source low-code platform. Prior to 3.38.…4.2
Are you affected by CVE-2026-46416?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST