Microsoft UFO, an open-source framework for intelligent automation, improperly manages WebSocket connections by reusing a single UFOWebSocketHandler instance across multiple authenticated clients. Mutable instance fields holding per-connection protocol objects are overwritten when new connections are established, leading to cross-connection data leakage where one client may receive responses meant for another. This is classified under CWE-284 (Improper Access Control) and CWE-488 (Exposure of Internal Implementation). The affected version is 3.0.1-4-ge2626659. The vulnerability is publicly known but lacks an official fix or patch at this time.

The vulnerability can lead to unauthorized disclosure of protocol responses between authenticated clients, potentially exposing sensitive information across sessions. This compromises confidentiality and integrity to a limited extent, as indicated by the CVSS vector (Confidentiality: Low, Integrity: Low, Availability: Low). There is no evidence of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider limiting the use of affected versions or isolating WebSocket connections to prevent cross-client data leakage. Monitor official Microsoft UFO repositories and advisories for updates.