CVE-2026-120006

Microsoft Security Advisory CVE-2026-120006 - Aspire Elevation of Privilege Vulnerability

Products / packages Microsoft Aspire.Hosting · Microsoft Aspire.Hosting.AppHost · Aspire.Hosting.AppHost · 1 more

Published 10/11/2026, 18:21:40 UTC

Severity and exploitation

Not in CISA KEVSource: HIGH

KEV coverage does not rule out exploitation.

KEV checked 15/11/2026, 04:45:31 UTC

OSV · CVSS:3.1 · 7.5

Assessment vector

CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H

microsoft · CVSS:3.1 · 7.5

Assessment vector

CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C

The headline uses the highest imported catalog score. Assessments can differ by source and CVSS version.

Severity

high7.5

CVSS measures technical severity, not the likelihood of an attack.

Known exploitation

Not listed in the checked CISA KEV catalog

Absence from CISA KEV does not rule out attacks.

Public exploit

Not established by this record

Missing evidence does not mean no public exploit exists.

Remediation

Package fixes recorded

Fix versions are recorded for 2 of 2 mapped packages. Check each release branch and any separate product guidance.

What this means

Aspire versions before 13.6.5 have an elevation of privilege vulnerability due to disclosure of an authentication cookie, allowing an attacker-controlled container to replay the authenticated session. The affected scenario involves a Dashboard-authenticated AppHost workflow with a linked HTTPS YARP gateway.

Summarized by @cf/meta/llama-3.3-70b-instruct-fp8-fast. Verify details against the original sources.

Attack conditions

No attack-condition excerpt has been identified here. Review the full source description and references for authentication, network access, and configuration requirements.

Review supporting sources →

Affected versions

Check the exact model, release, and any platform requirements against your installation.

Microsoft · microsoft

Aspire.Hosting

1 range

microsoft version evidence

Platforms: Mac OS

Check a product version

Compare with this publisher’s ranges. This does not inspect your installation.

affected

13.6.4 → before 13.6.5

custom versions

Other versions: unknown

Microsoft · microsoft

Aspire.Hosting.AppHost

1 range

microsoft version evidence

Platforms: Mac OS

Check a product version

Compare with this publisher’s ranges. This does not inspect your installation.

affected

13.6.4 → before 13.6.5

custom versions

Other versions: unknown

Packages

Compare each installed version with the publisher’s affected ranges. Where a fix is recorded, choose the appropriate release branch and test compatibility before upgrading.

Aspire.Hosting.AppHost NuGet

Affected range	Recorded fix
Earlier releases before 13.6.5Ecosystem versions	13.6.5

Version evidence: OSV · GHSA-f7vh-h5g3-7jrh

View original version evidence (54 explicit versions)

Aspire.Hosting NuGet

Affected range	Recorded fix
Earlier releases before 13.6.5Ecosystem versions	13.6.5

Version evidence: OSV · GHSA-f7vh-h5g3-7jrh

View original version evidence (55 explicit versions)

What to do

Compare your installed product and version with the affected versions above. A matching product name alone does not confirm exposure.

Use the recorded fix for your release branch. Review the publisher’s instructions and test compatibility before upgrading.

Update the AppHost project's Aspire.Hosting.AppHost package reference to version 13.6.5 or later.

OSV guidance ↗

cve.new guidance unless attributed to a publisher. This page does not inspect your installation.

Public exploit evidence

No public exploit reference is identified in the imported evidence. This is not a claim that no exploit exists.

Original source description

Read the full publisher description

Executive summary

Microsoft is releasing this security advisory to provide information about a vulnerability in Aspire. This advisory provides guidance on updating affected applications and components.

Disclosure of an Aspire Dashboard authentication cookie to a linked service can allow an attacker-controlled container to replay the authenticated session and execute code as the host developer.

Announcement

Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/503

CVSS Details

Version: 3.1
Severity: High
Score: 7.5
Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H
Weakness: CWE-201 (Insertion of Sensitive Information Into Sent Data)

Affected Platforms

Platforms: macOS
Architectures: x64, Arm64

<a name="affected-packages"></a>Affected Packages

Standalone Aspire

Package	Affected version	Patched version
Aspire.Hosting.AppHost	< 13.6.5	13.6.5
Aspire.Hosting	< 13.6.5	13.6.5

The affected scenario involves a Dashboard-authenticated AppHost workflow with an attacker-controlled container and a linked HTTPS YARP gateway. The affected hosting code is in Aspire.Hosting, a dependency of Aspire.Hosting.AppHost. Aspire.AppHost.Sdk supplies the AppHost package implicitly unless the project overrides the default references.

Advisory FAQ

<a name="how-affected"></a>How do I know if I am affected?

The reported scenario involves a developer starting an Aspire AppHost, authenticating to its Dashboard, and following a resource link that routes to an attacker-controlled container. All released versions through 13.6.4 are affected.

Aspire ships independently of .NET. Installing a .NET runtime or SDK update does not establish that the affected Aspire components have been updated.

<a name="how-fix"></a>How do I fix the issue?

Update the AppHost project's Aspire.Hosting.AppHost package reference to version 13.6.5 or later. If the project obtains this package implicitly through Aspire.AppHost.Sdk, update that SDK reference to version 13.6.5 or later. Explicit package references or central version pins must also resolve Aspire.Hosting to version 13.6.5 or later. Restore dependencies, rebuild, and restart the AppHost after updating.

Updating only the .NET runtime, .NET SDK, Aspire CLI, or standalone Dashboard does not replace the AppHost project's hosting dependencies.

Other Information

Reporting Security Issues

If you have found a potential security issue in a supported version of .NET, please report it to the Microsoft Security Response Center (MSRC) via the MSRC Researcher Portal. Further information can be found in the MSRC Report an Issue FAQ.

Security reports made through MSRC may qualify for the Microsoft .NET Bounty. Details of the Microsoft .NET Bounty Program including terms and conditions are at https://aka.ms/corebounty.

Support

You can ask questions about this issue in the Aspire repository.

Disclaimer

The information provided in this advisory is provided "as is" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.

External Links

CVE-2026-120006

Acknowledgements

samthewhitehat

Revisions

V1.0 (November 10, 2026): Advisory published.

References

8 sources

msrc.microsoft.com/update-guide/vulnerability/CVE-2026-120006

Vendor advisorymicrosoft

microsoft/aspire · security/advisories/GHSA-f7vh-h5g3-7jrh

Security advisory

nvd.nist.gov/vuln/detail/CVE-2026-120006

Security advisory

dotnet/announcements · issues/503

Source reference

microsoft/aspire · issues/22092

Source reference

microsoft/aspire · commit f017f66

Patch

View 2 more references

microsoft/aspire · repository

Source reference

microsoft/aspire · releases/tag/v13.6.5

Release notes

Inside the record

Evidence available

Package identity

Version evidence

Remediation guidance · not supplied

Weakness classification

Additional publishers

Describes the evidence in this view, not whether the product is safe.

Original records

CVE-2026-120006

View the latest unmodified CVE JSON from the official source. It may be newer than this imported page.

cve.new JSON →

Underlying weaknesses

The source’s classification of what caused the vulnerability.

CWE-201 ↗

CWE-201: Insertion of Sensitive Information Into Sent Data

microsoft

Environment requirements

These conditions apply together as specified by the publisher. A matching product name alone does not establish exposure.

microsoft · platform conditions

Any condition may hold

Vulnerable product

cpe:2.3:a:microsoft:aspire.hosting.apphost:*:*:*:*:*:*:*:*

From (inclusive): 13.6.4

After:

Through (inclusive):

Before: 13.6.5

Vulnerable product

cpe:2.3:a:microsoft:aspire.hosting:*:*:*:*:*:*:*:*

From (inclusive): 13.6.4

After:

Through (inclusive):

Before: 13.6.5

Applicability preview

[
  {
    "nodes": [
      {
        "operator": "OR",
        "negate": false,
        "cpeMatch": [
          {
            "vulnerable": true,
            "criteria": "cpe:2.3:a:microsoft:aspire.hosting.apphost:*:*:*:*:*:*:*:*",
            "versionStartIncluding": "13.6.4",
            "versionEndExcluding": "13.6.5"
          },
          {
            "vulnerable": true,
            "criteria": "cpe:2.3:a:microsoft:aspire.hosting:*:*:*:*:*:*:*:*",
            "versionStartIncluding": "13.6.4",
            "versionEndExcluding": "13.6.5"
          }
        ]
      }
    ]
  }
]

Contributing organizations · 2

microsoft

Assigning organization

2026-11-13

CISA-ADP

Additional data publisher

2026-11-10

Timeline

All times UTC

10 Nov 2026, 18:21
Advisory published
Publication date supplied by the source.
13 Nov 2026, 18:10
Source updated
Latest modification date supplied by the source.
13 Nov 2026, 18:36
Last imported by cve.new
Latest catalog import, not the date we first saw this advisory.

What changed

Follow changes

CVE · CVE-2026-1200062026-11-11

Observed 2026-11-11T01:13:03.621Z · upstream updated 2026-11-10T23:53:09.954Z

Product or version evidence changed

before

[
  {
    "vendor": "Microsoft",
    "name": "Aspire.Hosting",
    "platforms": [],
    "versions": [
      {
        "version": "13.6.4",
        "status": "affected",
        "lessThan": "13.6.5",
        "versionType": "custom"
      }
    ],
    "cpes": [],
    "source": "microsoft",
    "url": "https://www.cve.org/CVERecord?id=CVE-2026-120006"
  },
  {
    "vendor": "Microsoft",
    "name": "Aspire.Hosting.AppHost",
    "platforms": [],
    "versions": [
      {
        "version": "13.6.4",
        "status": "affected",
        "lessThan": "13.6.5",
        "versionType": "custom"
      }
    ],
    "cpes": [],
    "source": "microsoft",
    "url": "https://www.cve.org/CVERecord?id=CVE-2026-120006"
  }
]

after

[
  {
    "vendor": "Microsoft",
    "name": "Aspire.Hosting",
    "platforms": [
      "Mac OS"
    ],
    "versions": [
      {
        "version": "13.6.4",
        "status": "affected",
        "lessThan": "13.6.5",
        "versionType": "custom"
      }
    ],
    "cpes": [],
    "source": "microsoft",
    "url": "https://www.cve.org/CVERecord?id=CVE-2026-120006"
  },
  {
    "vendor": "Microsoft",
    "name": "Aspire.Hosting.AppHost",
    "platforms": [
      "Mac OS"
    ],
    "versions": [
      {
        "version": "13.6.4",
        "status": "affected",
        "lessThan": "13.6.5",
        "versionType": "custom"
      }
    ],
    "cpes": [],
    "source": "microsoft",
    "url": "https://www.cve.org/CVERecord?id=CVE-2026-120006"
  }
]

Large field values are marked as truncated previews. Original source snapshots remain retained.

Showing up to 50 most recent observed changes.

Reading the signals

Severity · CVSS: Technical impact and attack conditions. The headline is the highest imported catalog score; sources may disagree.
Observed exploitation · KEV: An absent or unavailable KEV listing does not establish that exploitation has not occurred.
Predicted exploitation · EPSS: No EPSS estimate available in this record.

CISA-ADP · SSVC

CISA Coordinator · 2026-11-10

Exploitation: none
Automatable: no
Technical Impact: total

SSVC describes the publisher’s decision context. Your organization’s exposure and priorities may differ.

Record identifiers

Aliases: GHSA-f7vh-h5g3-7jrh

Source evidence

Request a correction or dispute

Start with the assigning organization for this record. Include the CVE ID, the disputed information, and supporting evidence. A dispute does not itself reject a record.

Find the responsible CNA →Official dispute and escalation process ↗

OSV GHSA-f7vh-h5g3-7jrh CVE CVE-2026-120006