Executive brief
Microsoft UFO is an open-source framework used for automating tasks across different devices and platforms. A security flaw allows an authenticated user on one device to intercept and replace the results of tasks intended for a different device. This could lead to the automation system receiving and acting upon fraudulent data, potentially disrupting operations or compromising the integrity of automated workflows.
Technical details
The vulnerability exists in the Microsoft UFO constellation client's task tracking logic within 'connection_manager.py' and 'message_processor.py'. While the system records the expected device ID when a task is initiated, the completion path only validates the 'session_id' of incoming 'TASK_END' messages. An attacker with authenticated access to a peer device can send a forged 'TASK_END' message containing a known 'session_id'. Because the 'complete_task_response' function ignores the binding between the task and the original target device, it accepts the attacker's data and resolves the pending task's Future with the spoofed result. This is classified as an authenticated cross-device task-result injection issue.
Affected products
- Microsoft UFO (pip) 3.0.1-4-ge2626659
Timeline
- 2026-05-15: advisory: GitHub Security Advisory published
- 2026-05-27: disclosed: NVD publication date