CVE-2026-55440

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-55440

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-55440.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-55440

Aliases

GHSA-hxjv-fmjf-wmjf

Published

2026-07-16T15:35:51.346Z

Modified

2026-07-18T03:47:39.727440873Z

Severity

6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVSS Calculator

Summary

Microsoft UFO: COMMAND_RESULTS handler creates unowned sessions, allowing authenticated session-squatting denial of service

Details

Microsoft UFO open-source framework for intelligent automation across devices and platforms. Prior to 3.0.7, the COMMANDRESULTS handler in ufo/server/ws/handler.py called getorcreatesession in ufo/server/services/sessionmanager.py without ownerclientid, allowing an authenticated client to create an unowned attacker-chosen sessionid such as constellationtaskid = f"{taskname}@{taskid}" and deny the legitimate owner or exhaust memory with phantom sessions. This issue is fixed in version 3.0.7.

Database specific

{
    "cwe_ids": [
        "CWE-400",
        "CWE-862"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/55xxx/CVE-2026-55440.json",
    "cna_assigner": "GitHub_M"
}

References

Affected packages

Git / github.com/microsoft/ufo

Affected ranges

Type

GIT

Repo

https://github.com/microsoft/ufo

Events

Introduced

Fixed

cc653bde75337ab60c320e6b7cb61b86ba6ca948

Fixed

219b8f77eb47b4b7c10145fe49c1dc2f9438c287

Database specific

{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "3.0.7"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

3.*

3.0.6

v3.*

v3.0.0

v3.0.1

v3.0.2

v3.0.3

v3.0.4

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-55440.json"