Authenticated WebSocket Role Spoofing Vulnerability in Microsoft UFO Framework

CVE-2026-46414

What is CVE-2026-46414?

The Microsoft UFO open-source framework for intelligent automation is susceptible to a significant vulnerability due to its WebSocket control plane's improper handling of client-supplied identity and role fields. This flaw allows an authenticated WebSocket client with a shared server token to impersonate a higher-privilege role, specifically 'constellation', which leads to the potential hijacking of tasks intended for other connected devices. The vulnerability can be exploited when a client connection initially registers as a standard device yet is capable of sending deceptive TASK messages, thus overriding legitimate identities and roles. Furthermore, the client registry mechanism enables duplicate client identifier registrations, which can compromise the security of existing connections by overwriting essential control parameters.

References