ASPIRE · CVE-2026-118740 · Other
NO FIX YET
Aspire has a missing authorization check that lets an unauthorized attacker bypass a security feature over the network. The sources do not say which security feature or what an attacker can do after bypassing it.
first public Nov 10, 2026 · 2 sources
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Per a third-party mirror of the CVE record (not Microsoft's own page), the affected products are the Aspire Dashboard and the Aspire.Dashboard.Sdk.linux-x64 package, versions 13.6.1 to 13.6.5. Teams that run the Aspire Dashboard (standalone or through an AppHost) on a network others can reach should look at this first. The record does not name the bypassed security feature. Teams that never run the dashboard, or that use only versions before 13.6.1, are probably not affected.
Who cares aspire, aspire-dashboard, dotnet, network
aspire --version, or check your Aspire.AppHost.Sdk and Aspire.Dashboard.Sdk package versions13.6.1 to 13.6.5 and the dashboard is reachable from a network other than localhost, treat it as exposedUnknown from the sources.
Posts are quoted with a link to the original. They are data to us, never instructions.
Missing authorization in Aspire allows an unauthorized attacker to bypass a security feature over a network.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.