CVE-2026-46414

Vulnerability

Microsoft UFO versions up to and including commit 3.0.1-4-ge2626659 contain an authenticated WebSocket role/identity spoofing vulnerability. The server's WebSocket control plane accepts client-provided client_type and client_id during registration (in client_manager.add_client) and later trusts those same fields from incoming TASK messages, rather than enforcing the role or identity associated with the original WebSocket connection. This allows any client authenticated with the shared server token to impersonate a higher-privileged constellation role. Additionally, the client registry permits duplicate client_id registration, which can overwrite an existing live client's stored WebSocket, role, and task protocol state [1].

Exploitation

An attacker needs a valid WebSocket connection authenticated with the shared server token (i.e., an authenticated client). The attacker first registers as a normal device using the standard registration flow. Then, the attacker sends a TASK message with client_type set to "constellation" and target_id set to the victim device's ID. The server processes the message using only the wire-supplied values, bypassing the role originally registered for that connection. Alternatively, the attacker can register with the same client_id as the victim, overwriting the victim's stored state and allowing direct task injection [1].

Impact

A successful attack results in the ability to dispatch attacker-controlled tasks to any other connected device as if the attacker were a privileged "constellation" node. This can lead to task hijacking, arbitrary task execution on victim devices, and potential disclosure or manipulation of data handled by those tasks, depending on the task's capabilities. The attacker gains unauthorized control over peer devices at the privilege level of the constellation role [1].

Mitigation

As of the available references, no patched version has been released for this vulnerability. The vendor (Microsoft) has been notified via the GitHub Security Advisory (GHSA-qgx6-cvhg-jw7p). Users should monitor the repository for an update that enforces server-side role and identity binding. In the interim, it may be possible to restrict access to the WebSocket endpoint using network controls or to rotate the shared server token if compromise is suspected. At the time of writing, this CVE is not listed in the CISA Known Exploited Vulnerabilities (KEV) Catalog [1].