Description
Insertion of sensitive information into sent data in .NET Aspire allows an authorized attacker to elevate privileges locally.
Published: 2026-11-10
Score: 7.5 High
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Remediation

No vendor fix or workaround currently provided.

Additional remediation guidance may be available on OpenCVE Cloud.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 10 Nov 2026 18:30:00 +0000

Type Values Removed Values Added
Description Insertion of sensitive information into sent data in .NET Aspire allows an authorized attacker to elevate privileges locally.
Title Aspire Elevation of Privilege Vulnerability
First Time appeared Microsoft
Microsoft aspire.hosting
Microsoft aspire.hosting.apphost
Weaknesses CWE-201
CPEs cpe:2.3:a:microsoft:aspire.hosting.apphost:*:*:*:*:*:*:*:*
cpe:2.3:a:microsoft:aspire.hosting:*:*:*:*:*:*:*:*
Vendors & Products Microsoft
Microsoft aspire.hosting
Microsoft aspire.hosting.apphost
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C'}

Subscriptions

Microsoft Aspire.hosting Aspire.hosting.apphost
cve-icon MITRE

Status: PUBLISHED

Assigner: microsoft

Published:

Updated: 2026-11-10T18:47:21.887Z

Reserved: 2026-10-30T17:58:13.878Z

Link: CVE-2026-120006

cve-icon Vulnrichment

No data.

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses
  • CWE-201

    Insertion of Sensitive Information Into Sent Data