CVE-2026-105792

Executive Summary

CVE-2026-105792 is a denial-of-service vulnerability in Microsoft UFO (an open-source intelligent automation framework), affecting versions prior to 3.0.9. The flaw resides in the /api/task_result/{task_name} endpoint, which acquires a non-reentrant lock and subsequently re-acquires the same lock when resolving a mapped task name, causing the request to block indefinitely. An authenticated attacker who knows or creates a valid task name can exploit this in the default single-process server configuration to hang the event-loop thread, disrupting all HTTP, WebSocket, and dependent background interactions with a CVSS score of 6.5 (High availability impact).

Technical Analysis

Microsoft UFO is a framework designed for intelligent automation across devices and platforms, exposing HTTP and WebSocket interfaces for orchestrating automated tasks. The vulnerability specifically affects the SessionManager service implemented in ufo/server/services/session_manager.py.

The root cause is a classic deadlock condition arising from improper lock usage. The method SessionManager.get_result_by_task() performs the following sequence when invoked (as detailed in the NVD description):

1. Acquires a non-reentrant lock.
2. Calls SessionManager.get_result(), which attempts to acquire the same non-reentrant lock again.
3. Because the lock is non-reentrant, the second acquisition blocks indefinitely. The thread holding the lock (the request-handling thread) is unable to proceed, and any other thread waiting on the same lock is also blocked.

This behavior occurs only when the provided task_name maps to an existing session. If the task name is unknown, the nested call to get_result() is not reached, and the request completes without triggering the deadlock. The vulnerability is exposed via the /api/task_result/{task_name} endpoint, which requires authentication (PR:L). An attacker who is authenticated and knows or can create a valid mapped task name can trigger the deadlock at will.

The issue is classified as CWE-833: Deadlock. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) indicates the following:

• Attack Vector (AV:N): The vulnerability is exploitable remotely over the network.
• Attack Complexity (AC:L): No special conditions beyond knowledge of a valid task name are needed.
• Privileges Required (PR:L): The attacker must have low-level authenticated access to the application.
• User Interaction (UI:N): No user action is required.
• Scope (S:U): The impact is confined to the vulnerable component.
• Confidentiality (C:N): No data exposure.
• Integrity (I:N): No data modification.
• Availability (A:H): Complete loss of availability due to the deadlock.

In the default single-process server configuration, the blocked event-loop thread directly prevents the server from processing any further HTTP requests, WebSocket messages, or dependent background interactions, effectively rendering the entire UFO instance unresponsive.

Exploitation Scenarios

1) Reconnaissance and Target Identification The attacker first identifies a publicly accessible UFO instance, typically listening on its default HTTP port. Shodan dorks such as http.html:"api/task_result" or http.title:"UFO" can locate exposed instances. The attacker then authenticates using valid low-privileged credentials, which could be obtained through phishing, credential stuffing, or by exploiting other access-control weaknesses.

2) Triggering the Deadlock Once authenticated, the attacker needs a valid task name that maps to an active session. This can be achieved by creating a new task through normal application functionality or by knowing an existing task name (e.g., via prediction, enumeration, or insider knowledge). The attacker then sends an HTTP GET request to /api/task_result/{task_name} with the chosen task name. The server attempts to service the request by calling SessionManager.get_result_by_task(), which acquires the non-reentrant lock. The subsequent internal call to SessionManager.get_result() then attempts to re-acquire the same lock, causing the request thread to block indefinitely.

3) Payload and Execution Method No special payload is required beyond a valid task name in the URL path. The attack is a simple HTTP GET request, making it trivial to execute with tools like curl, Burp Suite, or a custom script. The blocking behavior consumes server resources (the event-loop thread), and in the default single-process configuration it halts all concurrent processing.

4) Post-Exploitation Impact The immediate effect is a denial of service: the UFO instance becomes unresponsive to all users. Because the event loop is blocked, other HTTP requests, WebSocket communications, and background task interactions cannot be processed. The server may require a restart to recover. In multi-process deployments the impact is limited to the affected worker process, but the default configuration is single-process, making the entire service vulnerable. Repeated exploitation after each restart can maintain a sustained outage, disrupting automated workflows that depend on UFO.

Impact Assessment

The vulnerability results in a high availability impact (CVSS A:H) while confidentiality and integrity are unaffected (C:N/I:N). An authenticated attacker can cause a complete denial of service against the UFO server, disrupting all automation tasks, API interactions, and WebSocket clients. The blast radius includes any downstream systems, users, or business processes that rely on the UFO instance for intelligent automation. Because authentication is required (PR:L), the attack is more likely from an insider or an external attacker who has obtained valid credentials. The scope remains unchanged (S:U), as the impact is confined to the UFO application itself.

The EPSS score is not yet available; however, the absence of a public PoC or Nuclei template currently limits opportunistic exploitation. The technical simplicity of the attack (a single crafted HTTP request) makes it attractive for targeted attacks or insider threats. There is no evidence of CISA KEV inclusion or active exploitation in the wild at this time.

Detection Guidance

Sigma Rule

title: Microsoft UFO Task Result Deadlock Attempt
id: 8f2a5c1e-9d3b-4a7c-b6e0-1f2a3b4c5d6e
status: experimental
description: Detects repeated requests to /api/task_result/ with a valid task name leading to deadlock, observed as a spike in response time or connection hang.
author: Threat Intelligence Team
logsource:
  category: webserver
  product: windows
  service: iis
detection:
  selection:
    cs-method: 'GET'
    cs-uri-stem|startswith: '/api/task_result/'
    sc-status: 200
  condition: selection
  timeframe: 5m
  # Additional correlation for multiple identical requests within short period
  # may indicate exploitation attempt
falsepositives:
  - Legitimate task result polling
level: medium
tags:
  - attack.t1499
  - cve.2026-105792

YARA Rule

rule CVE_2026_105792_UFO_Deadlock_Request
{
    meta:
        description = "Detects HTTP requests targeting the vulnerable endpoint in logs or PCAP"
        author = "Threat Intelligence Team"
        reference = "CVE-2026-105792"
        date = "2026-01-01"
        severity = "medium"
    strings:
        $endpoint = "/api/task_result/" ascii wide nocase
        $method = "GET " ascii
    condition:
        all of them
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-105792 Microsoft UFO Task Result Deadlock Attempt"; flow:to_server,established; content:"GET"; http_method; content:"/api/task_result/"; http_uri; nocase; classtype:attempted-dos; reference:cve,2026-105792; sid:1000001; rev:1;)

Elastic Detection

sequence by process.entity_id
  [network where http.request.method == "GET" and url.path : "/api/task_result/*"]
  [network where http.request.method == "GET" and url.path : "/api/task_result/*"]

Splunk SPL Query

index=web sourcetype=access_combined
| search method=GET uri_path="/api/task_result/*"
| stats count by clientip, uri_path, status
| where count > 5 AND status=200
| sort - count

Wazuh OSSEC Rule

<group name="web,appsec,">
  <rule id="100200" level="10">
    <decoded_as>web-accesslog</decoded_as>
    <match>GET /api/task_result/</match>
    <description>CVE-2026-105792: Microsoft UFO deadlock attempt detected</description>
    <group>cve_2026_105792,</group>
    <mitre>
      <id>T1499</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 0/4 — UNPATCHED. No patch evidence from any tracked source. The vendor has fixed the issue in version 3.0.9, but no official patch metadata or workarounds are currently available in the provided intelligence.

1. Immediate Mitigations:

   • Restrict network access to the UFO server, allowing only trusted IPs or requiring VPN.
   • Enforce strong authentication and monitor for anomalous requests to /api/task_result/{task_name}.
   • Implement rate limiting on the endpoint to prevent repeated exploitation.
   • If possible, deploy UFO in a multi-process configuration (e.g., using a WSGI server with multiple workers) to isolate the deadlock to a single worker, though this is not a complete fix.
   • Consider a reverse proxy with request timeouts to terminate hung connections.

2. Patch/Upgrade Steps:

   • Upgrade to Microsoft UFO version 3.0.9 or later as soon as it becomes available through official channels.
   • Monitor the project's repository and vendor advisories for the official release and CVE fix confirmation.
   • Validate the patch by testing the endpoint with a known task name to ensure no deadlock occurs.

3. Long-Term Hardening:

   • Conduct code review of locking mechanisms to identify other potential deadlocks or re-entrancy issues.
   • Implement structured concurrency with timeout and cancellation support for lock acquisitions.
   • Adopt a defensive programming approach: avoid nested lock acquisitions; use reentrant locks only when necessary and with careful design.
   • Integrate automated deadlock detection during testing (e.g., via static analysis or runtime tools).
   • Maintain an inventory of all exposed API endpoints and enforce strict authentication and authorization checks.

References

• NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-105792
• Microsoft UFO GitHub Repository: https://github.com/microsoft/UFO
• CWE-833: Deadlock — https://cwe.mitre.org/data/definitions/833.html
• MITRE ATT&CK T1499: Endpoint Denial of Service — https://attack.mitre.org/techniques/T1499/
• CVSS v3.1 Specification: https://www.first.org/cvss/v3.1/specification-document

No public PoC, exploit code, or threat actor campaigns have been observed for this CVE at the time of writing. CISA KEV status: Not listed.