Microsoft Aspire.Cli: Information disclosure through log file
Summary
Aspire CLI writes sensitive information into a log file during a scan by its deprecated MCP configuration scanner. A local attacker with a low-privilege account can read this log and obtain information such as another user's configuration, including stored credentials. The issue affects Linux and macOS builds; the attack requires some user interaction.
Affected
- Aspire.Cli standalone package from 13.2.0, before 13.6.5
- Linux and macOS builds from 13.3.0, before 13.6.5
- npm package @microsoft/aspire-cli from 13.4.2, before 13.6.5
- Windows is not listed as affected by Microsoft.
- The CVE record lists 13.5.4 as the start version; this conflicts with the Microsoft table, which should be used for checking.
Fixed in
- Update Aspire CLI to version 13.6.5 or later.
- If installed as a .NET tool, update the Aspire.Cli package.
Workaround
- Microsoft lists no workaround.
- Unknown whether a vendor-supplied workaround exists beyond the update.
Exploitation
- Microsoft reports the vulnerability as not publicly disclosed and not exploited; exploitability is rated Exploitation Less Likely.
- CISA SSVC: Exploitation none, Automatable no, Technical Impact partial.
- No public proof of concept was found.
- One aggregator lists it as not in the CISA KEV catalogue; this was not checked directly.
Our recommendation
- Update Aspire CLI to 13.6.5 or later wherever it is installed on Linux or macOS, prioritising shared hosts, terminal servers and CI/CD runners.
- Check the installed version by package type, as the advisory lists different start versions.
- Delete leftover Aspire scan log files from shared temporary directories after upgrading.
- Rotate any credential that may have been written to a log file.
- Priority for SMEs: low to medium. Windows-only and single-user workstation environments are less exposed.
Information from Microsoft (Patch Tuesday November 2026)
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Microsoft Security Update Guide: CVE-2026-120792 msrc.microsoft.com
- CVE Record CVE-2026-120792 www.cve.org
- GitHub issue microsoft/aspire #22100 (advisory mirror) github.com
- Strix aggregator entry CVE-2026-120792 www.strix.ai
- CVEreports analysis CVE-2026-120792 cvereports.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 13:32.
Original description (NVD)
Insertion of sensitive information into log file in Aspire allows an authorized attacker to disclose information locally.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.