{"id":"CVE-2026-120792","kind":"vulnerability","aliases":["CVE-2026-120792"],"related":[],"title":".NET Aspire: sensitive information written to log files, locally readable","description":"Insertion of sensitive information into log file in .NET Aspire allows an authorized attacker to disclose information locally.","summary":"A flaw in .NET Aspire causes sensitive information to be inserted into log files. An authorized attacker with local access can read that information from the logs.","severity":"high","cvss":7.3,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":".NET Aspire","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["aspire","developers","dotnet","runtime"],"not_affected_if":["logs-not-shared","no-dotnet-aspire"],"how_to_check":"- Confirm whether the project uses .NET Aspire by searching the solution for the `Aspire` package references.\n- Check the installed Aspire version against the fixed version in the vendor advisory (unknown from sources).","fix":null,"status":"open","published_at":"2026-11-10T19:20:28+00:00","first_seen_at":"2026-11-10T19:25:08+00:00","triaged_at":"2026-11-10T19:47:39+00:00","updated_at":"2026-11-10T19:47:39+00:00","category":"runtime","confidence":0.5,"triage":{"at":"2026-11-10T19:47:39Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":".NET Aspire: sensitive information written to log files, locally readable","impact":"medium","summary":"A flaw in .NET Aspire causes sensitive information to be inserted into log files. An authorized attacker with local access can read that information from the logs.","audience":"developers","category":"runtime","nicknames":[],"who_cares":["dotnet","aspire","developers"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"local user reads sensitive data written into logs","analyst_note":"Find the affected and fixed Aspire versions and the exact sensitive data logged, from the NVD entry and the Microsoft advisory.","how_to_check":"- Confirm whether the project uses .NET Aspire by searching the solution for the `Aspire` package references.\n- Check the installed Aspire version against the fixed version in the vendor advisory (unknown from sources).","plain_action":"","product_name":".NET Aspire","needs_analyst":true,"not_affected_if":["no-dotnet-aspire","logs-not-shared"],"who_is_affected":"Teams that use .NET Aspire for local development or hosting and write its logs somewhere other users can read. The sources do not say which Aspire versions or hosting modes are affected, and an attacker needs an authorized local account.","user_interaction":"no","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000703,"input_tokens":4488,"output_tokens":508,"severity_before":"high"},"analyst_status":"queued","analyst_note":"Find the affected and fixed Aspire versions and the exact sensitive data logged, from the NVD entry and the Microsoft advisory.","search":"'-120792':13A,16A '-2026':12A,15A 'access':42B 'allow':60C 'aspir':2A,19B,27B,59C 'aspire':18A 'attack':39B,63C 'author':38B,62C 'caus':28B 'cve':11A,14A 'develop':20B 'disclos':65C 'dotnet':21B 'file':8A,36B,56C 'flaw':24B 'inform':4A,30B,46B,53C,66C 'insert':33B,50C 'local':9A,41B,67C 'log':7A,35B,49B,55C 'net':1A,17A,26B,58C 'read':44B 'readabl':10A 'runtim':22B 'sensit':3A,29B,52C 'written':5A","nicknames":[],"mitigations":[],"who_affected":"Teams that use .NET Aspire for local development or hosting and write its logs somewhere other users can read. The sources do not say which Aspire versions or hosting modes are affected, and an attacker needs an authorized local account.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"developers","plain_action":null,"pkeys":["aspire","netaspire"],"ptokens":["aspire","net"],"labels":["aspire","developers","dotnet","high","runtime","vendor"],"campaign_type":null,"search_a":"'-120792':13A,16A '-2026':12A,15A 'aspir':2A 'aspire':18A 'cve':11A,14A 'file':8A 'inform':4A 'local':9A 'log':7A 'net':1A,17A 'readabl':10A 'sensit':3A 'written':5A","search_b":"'access':42B 'aspir':19B,27B 'attack':39B 'author':38B 'caus':28B 'develop':20B 'dotnet':21B 'file':36B 'flaw':24B 'inform':30B,46B 'insert':33B 'local':41B 'log':35B,49B 'net':26B 'read':44B 'runtim':22B 'sensit':29B","search_c":"'allow':60C 'aspir':59C 'attack':63C 'author':62C 'disclos':65C 'file':56C 'inform':53C,66C 'insert':50C 'local':67C 'log':55C 'net':58C 'sensit':52C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:20:28+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:L","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-120792","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120792","severity":null,"published_at":"2026-11-10T19:20:28+00:00","modified_at":"2026-11-10T19:20:28+00:00","first_seen_at":"2026-11-10T19:25:08+00:00","fetched_at":"2026-11-10T19:25:08+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}