Critical, CVSS 9.1NuGetPublished
Microsoft Security Advisory CVE-2026-118740 - Aspire Security Feature Bypass Vulnerability
CVE-2026-118740 · GHSA-4g86-54fm-h9h8
- Affected
- NuGet aspire.dashboard.sdk.osx-x64 < 13.6.5
- Fixed in
- 13.6.5· Vendor fix available
- Issue
- Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in Aspire. This advisory provides guidance on updating affected applications and components. Aspire Dashboard's unauthenticated NotFound route can permit telemetry deletion in both standalone and AppHost-hosted deployments. In standalone deployments using browser-token authentication, it can also expose the browser token. Announcement Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/526 CVSS Details - Version: 3.1 - Severity: Critical - Score: 9.1 - Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N - Weakness: CWE-862 Affected Platforms - Platforms: Any supported OS - Architectures: x64, Arm64 <a name="affected-packages"</aAffected Packages Standalone Aspire Dashboard Package | Affected version | Patched version --- | --- | --- Aspire Dashboard | < 13.6.5 | 13.6.5 Both 13.6.3 and 13.6.4 contain the unauthenticated NotFound route.…
Recommended action: Upgrade to 13.6.5 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.