CVE-2026-55440

Name of the Vulnerable Software and Affected Versions Microsoft UFO versions prior to 3.0.7

Description The COMMAND RESULTS handler in ufo/server/ws/handler.py calls the get or create session() function in ufo/server/services/session manager.py without providing the owner client id. This allows an authenticated client to create an unowned session using an attacker-chosen session id, such as constellation task id. This can lead to memory exhaustion through the creation of phantom sessions or a denial of service for the legitimate owner.

Recommendations Update to version 3.0.7.