.NET ASPIRE · CVE-2026-120792 · Runtime
NO FIX YET
A flaw in .NET Aspire causes sensitive information to be inserted into log files. An authorized attacker with local access can read that information from the logs.
first public Nov 10, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Teams that use .NET Aspire for local development or hosting and write its logs somewhere other users can read. The sources do not say which Aspire versions or hosting modes are affected, and an attacker needs an authorized local account.
Not affected if logs-not-shared, no-dotnet-aspire
Who cares aspire, developers, dotnet
Aspire package references.No fix yet, per the sources.
Insertion of sensitive information into log file in .NET Aspire allows an authorized attacker to disclose information locally.
This page as .md · .json · CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:L
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.