JEDI-SEC | Security Research & Digital Defense

GHSA-4g86-54fm-h9h8: Microsoft Security Advisory CVE-2026-118740 – Aspire Security Feature Bypass Vulnerability

Written by

jedisec_u136k7

in

  • Severity: CRITICAL
  • CVE: CVE-2026-118740
  • Ecosystems: nuget, nuget, nuget, nuget, nuget, nuget, nuget
  • Packages: Aspire.Dashboard.Sdk.linux-x64, Aspire.Dashboard.Sdk.linux-arm64, Aspire.Dashboard.Sdk.linux-musl-x64, Aspire.Dashboard.Sdk.osx-x64, Aspire.Dashboard.Sdk.osx-arm64, Aspire.Dashboard.Sdk.win-x64, Aspire.Dashboard.Sdk.win-arm64

## Executive summary

Microsoft is releasing this security advisory to provide information about a vulnerability in Aspire. This advisory provides guidance on updating affected applications and components.

Aspire Dashboard’s unauthenticated NotFound route can permit telemetry deletion in both standalone and AppHost-hosted deployments. In standalone deployments using browser-token authentication, it can also expose the browser token.

## Announcement

Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/526

## CVSS Details

– **Version:** 3.1
– **Severity:** Critical
– **Score:** 9.1
– **Vector:** `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N`
– **Weakness:** CWE-862

## Affected Platforms

– **Platforms:** Any supported OS
– **Architectures:** x64, Arm64

## Affected Packages

### Standalone Aspire Dashboard

Package | Affected version | Patched version
— | — | —
Aspire Dashboard | < 13.6.5 | 13.6.5

Both 13.6.3 and 13.6.4 contain the unauthenticated NotFound route.

### Aspire Dashboard SDK packages

Package | Affected version | Patched version
— | — | —
[Aspire.Dashboard.Sdk.linux-x64](https://www.nuget.org/packages/Aspire.Dashboard.Sdk.linux-x64) | < 13.6.5 | 13.6.5
[Aspire.Dashboard.Sdk.linux-arm64](https://www.nuget.org/packages/Aspire.Dashboard.Sdk.linux-arm64) | < 13.6.5 | 13.6.5
[Aspire.Dashboard.Sdk.linux-musl-x64](https://www.nuget.org/packages/Aspire.Dashboard.Sdk.linux-musl-x64) | < 13.6.5 | 13.6.5
[Aspire.Dashbo…

Source: GitHub Security Advisories · 2026-11-12

More posts