Microsoft .NET Aspire: Local privilege escalation via sensitive data exposure
Summary
Microsoft .NET Aspire inserts sensitive information into data it sends, in the Aspire.Hosting and Aspire.Hosting.AppHost NuGet packages. An authorized local attacker can use this to elevate privileges. Exploitation requires user interaction and a changed scope, and the CVSS base score is 7.5. The flaw is not reachable from the internet and mainly affects developer workstations, shared development servers and build systems that run Aspire AppHost projects.
Affected
- Aspire.Hosting 13.6.4 before 13.6.5
- Aspire.Hosting.AppHost 13.6.4 before 13.6.5
- Projects that receive these packages implicitly through Aspire.AppHost.Sdk with a version before 13.6.5
Fixed in
- Upgrade Aspire.Hosting and Aspire.Hosting.AppHost to 13.6.5 or later
- Raise the Aspire.AppHost.Sdk reference to 13.6.5 or later if the packages come through the SDK
- Updating the .NET runtime, SDK, Aspire CLI or standalone Dashboard does not replace the hosting packages
Workaround
Unknown. No workaround or mitigation was documented in the sources reviewed. The only published remediation is the upgrade to 13.6.5.
Exploitation
- Microsoft's exploitability assessment: Exploitation Less Likely
- Publicly disclosed: No
- Not known to be exploited and not listed in CISA KEV at the time of research
- No public proof of concept confirmed
- CISA SSVC: Exploitation none, Automatable no, Technical Impact total
Our recommendation
- Upgrade Aspire.Hosting and Aspire.Hosting.AppHost to 13.6.5 or later on developer workstations, shared dev servers and CI runners
- Check project files and restored dependency graphs, including transitive references and Aspire.AppHost.Sdk versions
- Verify the upgrade after restoring packages
- Priority: moderate, because the attack is local and requires several conditions; production systems are only affected if they run Aspire AppHost projects
Information from Microsoft (Patch Tuesday November 2026)
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Microsoft Security Response Center: CVE-2026-120006 msrc.microsoft.com
- CVE Record CVE-2026-120006 www.cve.org
- GitHub pull request scalar/scalar #10972 github.com
- Strix CVE details CVE-2026-120006 www.strix.ai
- Offseq Radar threat entry CVE-2026-120006 radar.offseq.com
- Rapid7 Patch Tuesday November 2026 www.rapid7.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 05:22.
Original description (NVD)
Insertion of sensitive information into sent data in .NET Aspire allows an authorized attacker to elevate privileges locally.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.