DEV Community: CVE Reports

CVE-2026-122006: CVE-2026-122006: Unauthenticated Arbitrary File Read and Write in Ruby on Rails Active Storage via ImageMagick

CVE Reports — Fri, 13 Nov 2026 00:31:20 +0000

CVE-2026-122006: Unauthenticated Arbitrary File Read and Write in Ruby on Rails Active Storage via ImageMagick

Vulnerability ID: CVE-2026-122006
CVSS Score: 9.8
Published: 2026-11-12

CVE-2026-122006 is a critical vulnerability in the Ruby on Rails Active Storage framework affecting versions prior to 8.0.5.2 and 8.1.4.1. When an application processes uploaded file attachments using the ImageMagick variant processor (:mini_magick), the framework invokes ImageMagick's metadata analyzer without applying a restrictive security policy. An unauthenticated attacker can upload a crafted file containing directives for unrestricted ImageMagick coders, such as Magick Scripting Language (MSL), resulting in arbitrary server-side file read and write operations. In deployments using the Disk storage service, attackers can exfiltrate sensitive application configuration files, including secret_key_base and master encryption keys, which enables remote code execution via signed payload forgery.

TL;DR

Active Storage prior to 8.0.5.2 and 8.1.4.1 invokes ImageMagick via MiniMagick without restricting dangerous coders (such as MSL, TEXT, EPHEMERAL, and Ghostscript delegates). Uploading a malicious attachment triggers automatic metadata analysis, enabling unauthenticated arbitrary file read and write on the server.

⚠️ Exploit Status: POC

Technical Details

CVE ID: CVE-2026-122006 (GHSA-f3w6-w445-fwh9)
Weakness Class: CWE-1188 (Initialization of a Resource with an Insecure Default)
Attack Vector: Network (Unauthenticated File Upload)
CVSS v3.1 Score: 9.8 CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
EPSS Score: 0.74% (55.14th Percentile)
Primary Impact: Arbitrary File Read & Write / Secret Exfiltration / RCE
Exploit Status: Proof-of-Concept & Detection Tooling Available
CISA KEV Status: Not Listed

Affected Systems

Ruby on Rails (activestorage gem < 8.0.5.2)
Ruby on Rails (activestorage gem >= 8.1.0, < 8.1.4.1)
activestorage: < 8.0.5.2 (Fixed in: 8.0.5.2)
activestorage: >= 8.1.0, < 8.1.4.1 (Fixed in: 8.1.4.1)

Code Analysis

Commit: 468aa9a

Ship a restrictive ImageMagick policy.xml in Active Storage and enforce mini_magick >= 5.1 via MAGICK_CONFIGURE_PATH.

Commit: ea8c401

Backport ImageMagick security policy enforcement for Active Storage.

Exploit Details

GitHub: Audit and detection script checking Gemfile.lock versions, variant_processor settings, and host ImageMagick policy.xml rules for CVE-2026-122006.
HackerOne: Original vulnerability disclosure report detailing the Active Storage ImageMagick security policy bypass.

Mitigation Strategies

Upgrade activestorage and mini_magick gems to patched releases that enforce a built-in ImageMagick security policy.
Migrate the Active Storage variant processor from :mini_magick to :vips (libvips).
Configure a system-wide ImageMagick policy.xml in /etc/ImageMagick-6/ or /etc/ImageMagick-7/ to disable dangerous coders (MSL, TEXT, EPHEMERAL, MPC, URL, FILE) and Ghostscript delegates.
Rotate all application secrets (secret_key_base, master.key, database credentials) if an affected application used the Disk storage service with untrusted uploads.

Remediation Steps:

Update Gemfile to require activestorage >= 8.0.5.2 (for Rails 8.0.x) or >= 8.1.4.1 (for Rails 8.1.x), and ensure gem 'mini_magick', '~> 5.1' is specified.
Run 'bundle update activestorage mini_magick' and redeploy the application.
Verify the active ImageMagick policy using: bin/rails runner 'puts MiniMagick.identify { |i| i.list "policy" }'.
If previously exposed with the Disk storage service, rotate secret_key_base, re-encrypt credentials.yml.enc with a new master key, and invalidate active sessions.

References

Read the full report for CVE-2026-122006 on our website for more details including interactive diagrams and full exploit analysis.

CVE-2026-128065: CVE-2026-128065: Authorization Bypass via Unapplied RBAC Overrides in @grpc/grpc-js-xds

CVE Reports — Thu, 12 Nov 2026 23:30:49 +0000

CVE-2026-128065: Authorization Bypass via Unapplied RBAC Overrides in @grpc/grpc-js-xds

Vulnerability ID: CVE-2026-128065
CVSS Score: 6.9
Published: 2026-11-12

CVE-2026-128065 (also tracked as GHSA-gg5j-6742-v827) is an authorization bypass vulnerability affecting the @grpc/grpc-js-xds library in the Node.js gRPC ecosystem. In versions 1.14.0 and 1.14.1, XdsServer acknowledges Route and VirtualHost resources from an xDS control plane while failing to parse, store, or apply RBACPerRoute override configurations. When experimental RBAC is enabled and a broad top-level ALLOW policy is paired with restrictive VirtualHost or Route overrides, the server evaluates requests strictly against the top-level policy, permitting unauthorized RPC execution.

TL;DR

An incorrect authorization flaw (CWE-863) in @grpc/grpc-js-xds versions 1.14.0 and 1.14.1 causes XdsServer to ignore VirtualHost and Route-level RBAC override configurations. Deployments relying on permissive top-level RBAC filters combined with restrictive route-specific overrides will fail to block unauthorized RPC requests. Upgrading @grpc/grpc-js-xds to version 1.14.2 resolves the issue.

⚠️ Exploit Status: POC

Technical Details

CVE ID: CVE-2026-128065 (GHSA-gg5j-6742-v827)
Weakness Class: CWE-863 (Incorrect Authorization)
CVSS v4.0 Score: 6.9 Medium (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N)
Affected Component: @grpc/grpc-js-xds (>= 1.14.0, < 1.14.2)
Attack Vector: Network (Unauthenticated gRPC Request)
Security Impact: Bypass of VirtualHost and Route RBACPerRoute authorization policies
Exploit Status: PoC Available (Official Unit Tests)
Patched Version: @grpc/grpc-js-xds 1.14.2

Affected Systems

@grpc/grpc-js-xds
grpc-node XdsServer
@grpc/grpc-js-xds: >= 1.14.0, < 1.14.2 (Fixed in: 1.14.2)

Code Analysis

Commit: b8f3ced

grpc-js-xds: Fix RBAC override config handling

File: packages/grpc-js-xds/src/http-filter/rbac-filter.ts
@@ -171,5 +171,10 @@ export function setup() {
       parseOverrideFilterConfig: parseOverrideRbacConfig,
       createServerFilter: createRbacServerFilter
     });
+    registerHttpFilter(RBAC_FILTER_OVERRIDE_URL, {
+      parseTopLevelFilterConfig: parseTopLevelRbacConfig,
+      parseOverrideFilterConfig: parseOverrideRbacConfig,
+      createServerFilter: createRbacServerFilter
+    });
   }
 }

File: packages/grpc-js-xds/src/server.ts
@@ -170,7 +170,7 @@ class FilterChainEntry {
       const filterConfig = parseTopLevelFilterConfig(filter.typed_config!, false);
       if (filterConfig) {
         const filterOverrideConfigMap = new Map<string, HttpFilterConfig>();
-        this.overrideConfigMaps.set(filterConfig.typeUrl, filterOverrideConfigMap);
+        this.overrideConfigMaps.set(filter.name, filterOverrideConfigMap);
         const filterInterceptor = createServerHttpFilter(filterConfig, filterOverrideConfigMap);
         if (filterInterceptor) {
           httpFilterInterceptors.push(filterInterceptor);
@@ -227,6 +227,14 @@ class FilterChainEntry {
         domains: virtualHost.domains,
         routes: []
       };
+      // filter name -> config
+      const virtualHostOverrideConfigs = new Map<string, HttpFilterConfig>()
+      for (const [filterName, overrideConfig] of Object.entries(virtualHost.typed_per_filter_config)) {
+        const parsedConfig = parseOverrideFilterConfig(overrideConfig);
+        if (parsedConfig) {
+          virtualHostOverrideConfigs.set(filterName, parsedConfig);
+        }
+      }
       for (const [routeIndex, route] of virtualHost.routes.entries()) {
         const routeEntry: RouteEntry = {
           id: `virtualhost=${virtualHostIndex} route=${routeIndex}`,
@@ -238,10 +246,19 @@ class FilterChainEntry {
           this.logConfigurationError('For domains matching [' + virtualHostEntry.domains + '] requests will be rejected for routes matching ' + routeEntry.matcher.toString());
         }
         virtualHostEntry.routes.push(routeEntry);
-        for (const [filterName, overrideConfig] of Object.entries(route.typed_per_filter_config)) {
-          const parsedConfig = parseOverrideFilterConfig(overrideConfig);
-          if (parsedConfig) {
-            this.overrideConfigMaps.get(filterName)?.set(routeEntry.id, parsedConfig);
+        for (const filterName of this.overrideConfigMaps.keys()) {
+          // Use the virtual host override by default
+          let routeOverrideConfig = virtualHostOverrideConfigs.get(filterName);
+          if (filterName in route.typed_per_filter_config) {
+            const parsedConfig = parseOverrideFilterConfig(route.typed_per_filter_config[filterName]);
+            if (parsedConfig) {
+              /* If the route has an override config and it parses successfully,
+               * use it instead because it is more specific. */
+              routeOverrideConfig = parsedConfig;
+            }
+          }
+          if (routeOverrideConfig) {
+            this.overrideConfigMaps.get(filterName)!.set(routeEntry.id, routeOverrideConfig);
           }
         }
       }

Exploit Details

GitHub: Official unit and integration regression tests demonstrating VirtualHost and Route-level RBAC override bypass scenarios.

Mitigation Strategies

Upgrade @grpc/grpc-js-xds to version 1.14.2 or later to ensure RBACPerRoute overrides in VirtualHost and Route resources are properly parsed and enforced.
Consolidate RBAC policies into the top-level HTTP filter configuration on the Listener resource rather than relying on VirtualHost or Route typed_per_filter_config overrides.
Implement application-layer authorization checks using native @grpc/grpc-js server interceptors to validate caller identity and permissions per RPC method.

Remediation Steps:

Audit Node.js projects and container images to identify installations of @grpc/grpc-js-xds versions 1.14.0 and 1.14.1.
Update package.json to require @grpc/grpc-js-xds version ^1.14.2 and run npm install or yarn upgrade.
Verify that xDS RouteConfiguration resources containing RBACPerRoute entries return status.PERMISSION_DENIED (code 7) for unauthorized test RPCs.
Redeploy affected Node.js gRPC server workloads.

References

Read the full report for CVE-2026-128065 on our website for more details including interactive diagrams and full exploit analysis.

CVE-2026-126188: CVE-2026-126188: Local Media Information Disclosure in Ruby on Rails Active Storage via FFmpeg Demuxer…

CVE Reports — Thu, 12 Nov 2026 22:30:49 +0000

CVE-2026-126188: Local Media Information Disclosure in Ruby on Rails Active Storage via FFmpeg Demuxer Selection

Vulnerability ID: CVE-2026-126188
CVSS Score: 3.7
Published: 2026-11-12

CVE-2026-126188 (GHSA-3f4q-8x5m-76v8) is an information disclosure vulnerability in the Active Storage component of Ruby on Rails prior to versions 8.0.5.2 and 8.1.4.1. When generating previews or extracting metadata from uploaded media files, Active Storage invokes the external command-line tools ffmpeg and ffprobe without specifying a format whitelist. An attacker who can upload a crafted HTTP Live Streaming (HLS) playlist while declaring a standard video or audio MIME type can cause FFmpeg to engage the HLS demuxer, resolve file:// segment URIs, and disclose visual frames or metadata from local media files readable by the Rails application process.

TL;DR

Active Storage prior to Rails 8.0.5.2 and 8.1.4.1 passes uploaded media files to ffmpeg and ffprobe without the -format_whitelist argument. Attackers can upload an HLS (.m3u8) playlist masquerading as a video or audio file to read local media files via the file:// protocol and leak their contents through generated thumbnail previews or metadata records.

⚠️ Exploit Status: POC

Technical Details

Vulnerability ID: CVE-2026-126188 / GHSA-3f4q-8x5m-76v8
Weakness Class: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
Affected Component: Active Storage (VideoPreviewer, VideoAnalyzer, AudioAnalyzer)
Attack Vector: Network (Crafted HLS .m3u8 Direct Upload with file:// Segment URIs)
CVSS v3.1 Score: 3.7 Low (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N)
EPSS Score: 0.28% (20.62nd Percentile)
Impact: Unauthorized disclosure of local media frames and metadata readable by the Rails process
Patched Versions: Rails 8.0.5.2, Rails 8.1.4.1

Affected Systems

Ruby on Rails (activestorage gem) < 8.0.5.2
Ruby on Rails (activestorage gem) >= 8.1.0, < 8.1.4.1
activestorage (Ruby on Rails): < 8.0.5.2 (Fixed in: 8.0.5.2)
activestorage (Ruby on Rails): >= 8.1.0, < 8.1.4.1 (Fixed in: 8.1.4.1)

Code Analysis

Commit: 3b1f262

Enforce -format_whitelist in Active Storage ffmpeg and ffprobe invocations (Rails 8.1 branch)

@@ -382,6 +382,12 @@ module ActiveStorage
   mattr_accessor :video_preview_arguments, default: "-y -vframes 1 -f image2"

+  mattr_accessor :ffmpeg_allowed_formats, default: %w[ mov matroska avi mpeg mpegts flv asf ogg mp3 wav flac aac aiff caf ].freeze
+
+  def self.ffmpeg_format_whitelist_arguments # :nodoc:
+    [ "-format_whitelist", Array(ffmpeg_allowed_formats).join(",") ] unless ffmpeg_allowed_formats.nil?
+  end

Commit: 69aff80

Enforce -format_whitelist in Active Storage ffmpeg and ffprobe invocations (Rails 8.0 branch)

@@ -30,7 +30,7 @@ def preview(**options)
     private
       def draw_relevant_frame_from(file, &block)
-        draw self.class.ffmpeg_path, "-i", file.path, *Shellwords.split(ActiveStorage.video_preview_arguments), "-", &block
+        draw self.class.ffmpeg_path, *ActiveStorage.ffmpeg_format_whitelist_arguments, "-i", file.path, *Shellwords.split(ActiveStorage.video_preview_arguments), "-", &block
       end
   end
 end

Mitigation Strategies

Enforce a strict container format allowlist (-format_whitelist) whenever invoking ffmpeg or ffprobe on untrusted files to prevent automatic probing of playlist demuxers like HLS.
Perform server-side binary MIME type identification on uploaded blobs rather than trusting client-declared content_type metadata during direct uploads.
Store uploaded blobs on isolated object storage services (such as Amazon S3, Google Cloud Storage, or Azure Blob Storage) rather than the local filesystem to minimize the presence of sensitive media files on the application host.

Remediation Steps:

Update the Gemfile to specify gem 'rails', '>= 8.0.5.2' (for 8.0.x) or '>= 8.1.4.1' (for 8.1.x).
Execute 'bundle update rails activestorage' and redeploy the application.
Verify that config.active_storage.ffmpeg_allowed_formats is not set to nil and does not include 'hls' in any environment configuration files.
If immediate upgrading is blocked, deploy an initializer that prepends '-format_whitelist' with safe container formats to VideoPreviewer, VideoAnalyzer, and AudioAnalyzer.

References

Read the full report for CVE-2026-126188 on our website for more details including interactive diagrams and full exploit analysis.

CVE-2026-126206: CVE-2026-126206: Cross-Site Scripting via HTML5 Named Solidus Entity in Loofah URI Validator

CVE Reports — Thu, 12 Nov 2026 21:30:49 +0000

CVE-2026-126206: Cross-Site Scripting via HTML5 Named Solidus Entity in Loofah URI Validator

Vulnerability ID: CVE-2026-126206
CVSS Score: 5.3
Published: 2026-11-12

CVE-2026-126206 (GHSA-jcff-cj73-4w4f) is a Cross-Site Scripting (XSS) vulnerability in version 2.25.2 of the Loofah Ruby gem. The vulnerability stems from an incomplete character reference normalization routine in the Loofah::HTML5::Scrub.allowed_uri? method, which fails to decode the HTML5 named character reference / (representing the solidus character /). Consequently, a crafted data: URI such as data:text/html,<script>alert(1)</script> bypasses mediatype validation by triggering the WHATWG MIME parser fallback to text/plain, while web browsers later resolve / to / and execute the payload as text/html.

TL;DR

Loofah 2.25.2 fails to decode the HTML5 named character reference / (/) inside Loofah::HTML5::Scrub.allowed_uri? (also exposed via Rails::HTML::Sanitizer.allowed_uri?). Attackers can supply data:text/html,<script>... to bypass URI validation as text/plain and achieve Cross-Site Scripting (XSS) when the URI is rendered into an HTML attribute.

⚠️ Exploit Status: POC

Technical Details

CVE / Advisory ID: CVE-2026-126206 / GHSA-jcff-cj73-4w4f
Vulnerability Class: CWE-79 (Cross-Site Scripting) / CWE-184 (Incomplete List of Disallowed Inputs)
CVSS v4.0 Score: 5.3 Medium (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N)
Affected Component: Loofah::HTML5::Scrub.allowed_uri? (loofah gem = 2.25.2)
Patched Version: loofah >= 2.25.3
Attack Vector: Network (Crafted data: URI using / HTML5 entity)
Exploit Status: Proof-of-Concept (PoC) Publicly Available
CISA KEV Status: Not Listed

Affected Systems

loofah Ruby gem (version 2.25.2)
rails-html-sanitizer (when invoking Rails::HTML::Sanitizer.allowed_uri? with loofah 2.25.2)
loofah: = 2.25.2 (Fixed in: 2.25.3)

Code Analysis

Commit: ad92002

Ensure Loofah::HTML5::Scrub.allowed_uri? recognizes the named character reference / and rejects data: URIs that disguise a disallowed mediatype with it.

diff --git a/lib/loofah/html5/scrub.rb b/lib/loofah/html5/scrub.rb
index 2a35090..e8b524a 100644
--- a/lib/loofah/html5/scrub.rb
+++ b/lib/loofah/html5/scrub.rb
@@ -53,6 +53,15 @@ module Scrub
       # URIs. CGI.unescapeHTML does not decode these, so they are handled explicitly.
       WHITESPACE_CHARACTER_REFERENCES = /&(Tab|NewLine);/

+      # HTML5 named character references for the delimiters that decide how a URI parses:
+      # ":" ends the scheme, and "/" separates the type and subtype of a data: mediatype.
+      # CGI.unescapeHTML does not decode these either. Together with
+      # WHITESPACE_CHARACTER_REFERENCES these are every named character reference that
+      # decodes to U+0009, U+000A, U+002F, or U+003A, so no other named reference can
+      # change how a URI parses.
+      DELIMITER_CHARACTER_REFERENCES = { "&colon;" => ":", "&sol;" => "/" }.freeze
+      DELIMITER_CHARACTER_REFERENCE = Regexp.union(DELIMITER_CHARACTER_REFERENCES.keys)
+
       class << self
         def allowed_element?(element_name)
           ::Loofah::HTML5::SafeList::ALLOWED_ELEMENTS_WITH_LIBXML2.include?(element_name)
@@ -234,12 +243,12 @@ def allowed_uri?(uri_string)
           # also decode the semicolon-less ones, which browsers still decode and execute. Normalizing
           # more aggressively than a browser only rejects more, which is safe. Control characters are
           # stripped both before and after decoding, since decoding can produce them. That strip must
-          # precede WHITESPACE_CHARACTER_REFERENCES: removing a control character can reveal a named
-          # whitespace reference.
+          # precede the named reference substitutions: removing a control character can reveal a
+          # named reference.
           uri_string = decode_numeric_character_references(CGI.unescapeHTML(uri_string.gsub(CONTROL_CHARACTERS, "")))
           uri_string.gsub!(CONTROL_CHARACTERS, "")
           uri_string.gsub!(WHITESPACE_CHARACTER_REFERENCES, "")
-          uri_string.gsub!("&colon;", ":")
+          uri_string.gsub!(DELIMITER_CHARACTER_REFERENCE, DELIMITER_CHARACTER_REFERENCES)
           uri_string.downcase!
           if URI_PROTOCOL_REGEX.match?(uri_string)
             protocol = uri_string.split(SafeList::PROTOCOL_SEPARATOR)[0]

Exploit Details

GitHub Security Advisory: Official advisory containing functional proof-of-concept data:text/html payloads.
GitHub Fix Commit & Unit Tests: Upstream unit tests demonstrating plaintext, base64, double-encoded, and control-character-injected / bypass vectors.

Mitigation Strategies

Upgrade the loofah Ruby gem to version 2.25.3 or newer across all environments.
Prefer full DOM fragment sanitization (Loofah.scrub_fragment or Rails sanitize helper) over standalone string validation via allowed_uri?.
Ensure all user-supplied URI strings rendered into HTML attributes pass through standard attribute escaping helpers (such as Rails link_to or tag.a) rather than raw .html_safe string interpolation.

Remediation Steps:

Audit project Gemfile.lock files using bundle list | grep loofah or bundle exec bundler-audit check --update to identify instances of loofah version 2.25.2.
Search application source code (app/, lib/, config/) for direct invocations of Loofah::HTML5::Scrub.allowed_uri? or Rails::HTML::Sanitizer.allowed_uri?.
Update Gemfile to require gem "loofah", ">= 2.25.3" and execute bundle update loofah.
Run the application test suite and redeploy affected services.

References

Read the full report for CVE-2026-126206 on our website for more details including interactive diagrams and full exploit analysis.

CVE-2026-125325: CVE-2026-125325: Cross-Request Information Disclosure via Shared BM25 Index Race Condition in pgEdge RAG Server

CVE Reports — Thu, 12 Nov 2026 20:30:50 +0000

CVE-2026-125325: Cross-Request Information Disclosure via Shared BM25 Index Race Condition in pgEdge RAG Server

Vulnerability ID: CVE-2026-125325
CVSS Score: 5.9
Published: 2026-11-12

pgEdge RAG Server versions prior to 2.0.0 contain a race condition in the hybrid search pipeline orchestrator (CWE-362, CWE-488). The server maintains a single shared, in-memory BM25 index instance across all incoming HTTP requests on a pipeline. Concurrent queries to the unauthenticated HTTP REST API interleave non-atomic clear, document addition, and search operations on this singleton index. As a result, documents fetched using one caller's search filter can be queried and returned to another concurrent caller, bypassing multi-tenant data isolation without generating any anomalous audit trail in server or database logs.

TL;DR

A concurrency flaw in pgEdge RAG Server (< 2.0.0) causes concurrent hybrid search requests to share and mutate a single in-memory BM25 keyword index. Attackers or concurrent users can receive document contents and synthesized LLM answers belonging to other tenants' filtered search scopes. Upgrading to version 2.0.0 resolves the issue by isolating BM25 index instances to individual requests.

⚠️ Exploit Status: POC

Technical Details

CVE ID: CVE-2026-125325 (GHSA-w437-9mwm-j6vq)
Vulnerability Class: CWE-362 (Race Condition) / CWE-488 (Exposure of Data Element to Wrong Session)
CVSS v3.1 Score: 5.9 Medium (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N)
Attack Vector: Network (Unauthenticated HTTP POST to /v1/pipelines/{name})
Primary Impact: Cross-request / Cross-tenant information disclosure of filtered RAG documents
Affected Versions: pgEdge RAG Server < 2.0.0
Patched Version: pgEdge RAG Server 2.0.0
EPSS / KEV Status: 0.27% (19.59th percentile) / Not Listed in CISA KEV

Affected Systems

pgEdge RAG Server (pgedge-rag-server)
pgEdge RAG Server: < 2.0.0 (including 1.0.0, 1.0.0-beta1 through 1.0.0-beta3-test, and 1.0.0-alpha1 through 1.0.0-alpha5) (Fixed in: 2.0.0)

Code Analysis

Commit: a09d487

Isolate BM25 index instances per request in Orchestrator.search and bound FetchDocuments with bm25_max_documents.

--- a/internal/pipeline/orchestrator.go
+++ b/internal/pipeline/orchestrator.go
@@ -33,7 +33,6 @@ type Orchestrator struct {
    completionProv Completer
    reranker       Reranker
    rerankTopK     int
-   bm25Index      *bm25.Index
    tokenBudget    int
    topN           int
    logger         *slog.Logger
@@ -66,7 +65,6 @@ func NewOrchestrator(cfg OrchestratorConfig) *Orchestrator {
        completionProv: cfg.CompletionProv,
        reranker:       cfg.Reranker,
        rerankTopK:     cfg.RerankTopK,
-       bm25Index:      bm25.NewIndex(),
        tokenBudget:    cfg.TokenBudget,
        topN:           cfg.TopN,
        logger:         logger,
@@ -345,7 +348,7 @@ func (o *Orchestrator) search(
            continue
        }

-       docs, err := o.dbPool.FetchDocuments(ctx, table, req.Filter)
+       docs, err := o.dbPool.FetchDocuments(ctx, table, req.Filter, maxBM25Docs)
        if err != nil {
            o.logger.Warn("failed to fetch documents for BM25",
                "table", table.Table, "error", err)
@@ -354,9 +357,28 @@ func (o *Orchestrator) search(
            continue
        }

-       o.bm25Index.Clear()
-       o.bm25Index.AddDocuments(docs)
-       bm25Results := o.bm25Index.Search(req.Query, topN*2)
+       if len(docs) >= maxBM25Docs {
+           o.logger.Warn(
+               "keyword search corpus truncated by bm25_max_documents; "+
+                   "keyword coverage for this request is partial",
+               "table", table.Table, "limit", maxBM25Docs,
+           )
+       }
+
+       index := bm25.NewIndex()
+       index.AddDocuments(docs)
+       bm25Results := index.Search(req.Query, topN*2)

Exploit Details

GitHub: Official concurrency regression test (TestSearch_ConcurrentRequestsDoNotShareKeywordIndex) demonstrating cross-tenant BM25 index leakage under concurrent load.

Mitigation Strategies

Upgrade pgEdge RAG Server to version 2.0.0 or later to ensure BM25 indexes are instantiated per request rather than shared across the pipeline.
Disable hybrid search (hybrid_enabled: false or vector_weight: 1.0) on pre-2.0.0 deployments to bypass the in-memory BM25 index entirely.
Disable raw source inclusion (allow_include_sources: false) in pipeline configurations to prevent raw cross-tenant document snippets from being returned in API responses.
Place pgEdge RAG Server behind an authenticating reverse proxy or API gateway with rate limiting to prevent unauthenticated concurrent query floods.

Remediation Steps:

Audit running processes and installed packages using dpkg -l | grep pgedge-rag-server (Debian/Ubuntu) or rpm -qa | grep pgedge-rag-server (RHEL/CentOS) to identify version 1.x installations.
Install pgEdge RAG Server version 2.0.0 or later (pgedge-rag-server2 package or compiled binary from release tag v2.0.0).
Migrate pipeline configuration files to the v2.0.0 format and verify search.bm25_max_documents is set to a positive integer (default: 10000).
Stop and disable any legacy v1.0.0 pgedge-rag-server systemd services listening on port 8080, and route all application traffic to the v2.0.0 service.

References

Read the full report for CVE-2026-125325 on our website for more details including interactive diagrams and full exploit analysis.

CVE-2026-118740: CVE-2026-118740: Missing Authorization in Microsoft Aspire Dashboard Blazor Router

CVE Reports — Thu, 12 Nov 2026 18:30:50 +0000

CVE-2026-118740: Missing Authorization in Microsoft Aspire Dashboard Blazor Router

Vulnerability ID: CVE-2026-118740
CVSS Score: 9.1
Published: 2026-11-12

CVE-2026-118740 is a Missing Authorization (CWE-862) vulnerability in the Microsoft Aspire Dashboard and Aspire.Dashboard.Sdk.linux-x64 packages. In versions 13.6.1 prior to 13.6.5, an architectural flaw in the Blazor routing configuration (Routes.razor) causes unmapped (404 / Not-Found) routes to bypass the AuthorizeRouteView component. By navigating to an arbitrary non-existent route, an unauthenticated remote attacker forces the application into the NotFound template, which unconditionally renders the primary MainLayout component and initializes global user interface services, interaction providers, and underlying SignalR/Blazor circuits without verifying authentication credentials.

TL;DR

An unauthenticated security feature bypass in Microsoft Aspire Dashboard (versions 13.6.1 through 13.6.4) allows remote attackers to initialize protected dashboard layouts and backend Blazor interactive circuits by requesting any non-existent URL path. Upgrading to Aspire 13.6.5 resolves the issue by enforcing authorization policies across both matched and unmatched routes and introducing lifecycle authentication guards.

⚠️ Exploit Status: POC

Technical Details

CVE ID: CVE-2026-118740
Weakness: CWE-862 (Missing Authorization)
CVSS v3.1 Score: 9.1 Critical (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N)
EPSS Score: 0.92% (60.87th Percentile)
Attack Vector: Network (Unauthenticated HTTP / Blazor Route Navigation)
Impact: Security Feature Bypass (Unauthorized Layout & Circuit Initialization)
Exploit Status: Proof-of-Concept (Playwright Integration Test)
CISA KEV Status: Not Listed

Affected Systems

Microsoft Aspire Dashboard
Aspire.Dashboard.Sdk.linux-x64
Aspire Dashboard: >= 13.6.1, < 13.6.5 (Fixed in: 13.6.5)
Aspire.Dashboard.Sdk.linux-x64: >= 13.6.1, < 13.6.5 (Fixed in: 13.6.5)

Code Analysis

Commit: 0b6bfe2

[release/13.6] Fix dashboard not-found authentication (PR 66656)

Commit: f017f66

Restrict container tunnels strictly to OTLP endpoints (PR 68055)

Mitigation Strategies

Upgrade Microsoft Aspire Dashboard and associated SDK packages to version 13.6.5 or later.
Place the Aspire Dashboard behind an authenticating reverse proxy (e.g., YARP, NGINX, Azure Application Gateway) to enforce authentication prior to request routing.
Bind the Aspire Dashboard frontend strictly to localhost (127.0.0.1) or isolate it within restricted management networks.

Remediation Steps:

Update .NET Aspire workloads and NuGet package references (including Aspire.Dashboard.Sdk.linux-x64) to version 13.6.5 or higher.
Rebuild and redeploy all Aspire AppHost and standalone Aspire Dashboard container images.
Verify the fix by navigating to an arbitrary non-existent route (e.g., /nonexistent) in an unauthenticated browser session and confirming an immediate redirect to /login?returnUrl=%2Fnonexistent.

References

Read the full report for CVE-2026-118740 on our website for more details including interactive diagrams and full exploit analysis.

CVE-2026-120006: CVE-2026-120006: Elevation of Privilege in .NET Aspire via Unintended Dashboard Endpoint Tunneling

CVE Reports — Wed, 11 Nov 2026 20:30:50 +0000

CVE-2026-120006: Elevation of Privilege in .NET Aspire via Unintended Dashboard Endpoint Tunneling

Vulnerability ID: CVE-2026-120006
CVSS Score: 7.5
Published: 2026-11-10

An elevation of privilege vulnerability exists in .NET Aspire versions prior to 13.6.5 due to the insertion of sensitive information into sent data (CWE-201). When the Developer Control Plane (DCP) container tunneling feature is enabled, the orchestration engine implicitly exposes all endpoints of the Aspire Dashboard—including its administrative frontend and management APIs—to containerized workloads instead of restricting tunnel access solely to OpenTelemetry Protocol (OTLP) collection endpoints. This exposure allows an attacker operating within a compromised or untrusted container to query the dashboard frontend, extract sensitive environment variables and connection strings, and elevate privileges across the host orchestration boundary.

TL;DR

.NET Aspire prior to 13.6.5 automatically tunnels the administrative dashboard frontend into container networks when container tunneling is enabled, allowing compromised containers to read sensitive host secrets and escalate privileges.

Technical Details

CVE ID: CVE-2026-120006
Weakness Class: CWE-201 (Insertion of Sensitive Information Into Sent Data)
CVSS v3.1 Score: 7.5 High (CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H)
Attack Vector: Local / Container Network Namespace (AV:L)
Affected Component: Aspire.Hosting & Aspire.Hosting.AppHost (< 13.6.5)
Patched Version: .NET Aspire 13.6.5
Exploit Status: Unproven / No Public PoC
CISA KEV Status: Not Listed

Affected Systems

Microsoft .NET Aspire (Aspire.Hosting)
Microsoft .NET Aspire (Aspire.Hosting.AppHost)
Aspire.Hosting: < 13.6.5 (Fixed in: 13.6.5)
Aspire.Hosting.AppHost: < 13.6.5 (Fixed in: 13.6.5)

Code Analysis

Commit: f017f66

Merged PR 68055: Limit automatic dashboard tunnelling to OTLP endpoints. Preserves explicit dashboard endpoint references and ordinary host-resource tunneling. Normalizes legacy host URLs into endpoint references at the dependency-discovery boundary.

if (_options.Value.EnableAspireContainerTunnel)
{
    var dashboardIndex = hostDependencies.FindIndex(dependency =>
        StringComparers.ResourceName.Equals(dependency.Resource.Name, KnownResourceNames.AspireDashboard));
    if (dashboardIndex >= 0)
    {
        // Telemetry must not implicitly expose the dashboard frontend. Preserve explicit endpoint
        // references without narrowing the endpoints exposed for ordinary host dependencies.
        var dashboard = hostDependencies[dashboardIndex];
        var endpoints = await GetDashboardTunnelEndpointsAsync(resource, dashboard, cancellationToken).ConfigureAwait(false);
        hostDependencies.RemoveAll(dependency =>
            StringComparers.ResourceName.Equals(dependency.Resource.Name, KnownResourceNames.AspireDashboard));
        if (endpoints.Length > 0)
        {
            hostDependencies.Add(new HostResourceWithEndpoints(dashboard.Resource, endpoints));
        }
    }
}

Mitigation Strategies

Upgrade .NET Aspire hosting packages (Aspire.Hosting and Aspire.Hosting.AppHost) to version 13.6.5 or later.
Disable automatic container tunneling by setting EnableAspireContainerTunnel to false in DcpOptions when host-to-container proxy tunnels are not required.
Enforce strong authentication on the .NET Aspire Dashboard frontend and restrict container network egress to non-essential host ports.
Sanitize sensitive environment variables, connection strings, and bearer tokens before emitting OpenTelemetry spans and structured logs.

Remediation Steps:

Locate all .csproj or Directory.Packages.props files within the solution that reference Aspire.Hosting or Aspire.Hosting.AppHost.
Update the Version attribute for both Aspire.Hosting and Aspire.Hosting.AppHost to 13.6.5 or higher.
Execute 'dotnet restore' and rebuild the application host project to link against the patched assemblies.
Restart any running .NET Aspire AppHost orchestration sessions and verify that container tunnels only bind OTLP ports (4317/4318) unless explicitly referenced.

References

Read the full report for CVE-2026-120006 on our website for more details including interactive diagrams and full exploit analysis.

CVE-2026-118750: CVE-2026-118750: Uncontrolled Resource Allocation in ASP.NET Core FileBufferingReadStream

CVE Reports — Wed, 11 Nov 2026 19:30:50 +0000

CVE-2026-118750: Uncontrolled Resource Allocation in ASP.NET Core FileBufferingReadStream

Vulnerability ID: CVE-2026-118750
CVSS Score: 7.5
Published: 2026-11-10

CVE-2026-118750 is an uncontrolled resource allocation vulnerability (CWE-770) affecting the Microsoft.AspNetCore.WebUtilities component in ASP.NET Core. Specifically, the FileBufferingReadStream class eagerly allocates large memory buffers from the shared ArrayPool inside its constructor prior to reading any incoming request payload data. An unauthenticated remote attacker can exploit this behavior by opening numerous concurrent connections and stalling or omitting request body transmission, exhausting shared memory pools and causing a server-wide Denial of Service (DoS).

TL;DR

An unauthenticated remote attacker can trigger an application-level Denial of Service in ASP.NET Core web applications using Microsoft.AspNetCore.WebUtilities (< 2.3.14) by initiating concurrent buffered HTTP requests that prematurely exhaust the shared ArrayPool via eager constructor allocations in FileBufferingReadStream.

Technical Details

CVE ID: CVE-2026-118750
Weakness Class: CWE-770 (Allocation of Resources Without Limits or Throttling)
CVSS v3.1 Score: 7.5 High (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Affected Component: Microsoft.AspNetCore.WebUtilities (FileBufferingReadStream)
Vulnerable Versions: >= 2.3.12, < 2.3.14
Patched Version: 2.3.14
Primary Impact: Endpoint Denial of Service (Memory Pool Exhaustion)
CISA KEV Status: Not Listed

Affected Systems

Microsoft.AspNetCore.WebUtilities
ASP.NET Core
Microsoft.AspNetCore.WebUtilities: >= 2.3.12, < 2.3.14 (Fixed in: 2.3.14)

Code Analysis

Commit: 9a26c74

Merged PR 67040: [release 2.3] Make FileBufferingReadStream lazily rent buffer

File: src/Http/WebUtilities/src/FileBufferingReadStream.cs
@@ -27,7 +27,6 @@ public class FileBufferingReadStream : Stream
         private string _tempFileName;

         private Stream _buffer;
-        private byte[] _rentedBuffer;
         private bool _inMemory = true;
         private bool _completelyBuffered;

@@ -62,9 +61,7 @@ public FileBufferingReadStream(
             _bytePool = bytePool;
             if (memoryThreshold < _maxRentedBufferSize)
             {
-                _rentedBuffer = bytePool.Rent(memoryThreshold);
-                _buffer = new MemoryStream(_rentedBuffer);
-                _buffer.SetLength(0);
+                _buffer = new PooledMemoryStream(bytePool, memoryThreshold);
             }
             else
             {

Mitigation Strategies

Upgrade Microsoft.AspNetCore.WebUtilities to version 2.3.14 or higher to replace eager ArrayPool allocations with lazy, geometrically scaling PooledMemoryStream allocations.
Enforce strict MinRequestBodyDataRate and MaxConcurrentConnections limits in Kestrel to rapidly terminate idle or slowloris-style HTTP connections.
Enable request body buffering and aggressive client body read timeouts on upstream reverse proxies (e.g., NGINX, HAProxy, Azure Application Gateway) to prevent incomplete requests from reaching the ASP.NET Core backend.
Restrict request buffering (EnableBuffering) and multipart form processing solely to endpoints that strictly require them, and apply authentication checks prior to reading or buffering request streams.

Remediation Steps:

Audit all .NET projects and dependency trees for references to Microsoft.AspNetCore.WebUtilities versions >= 2.3.12 and < 2.3.14.
Update the PackageReference for Microsoft.AspNetCore.WebUtilities to version 2.3.14 in affected .csproj or Directory.Packages.props files.
Rebuild, test, and redeploy the affected ASP.NET Core applications.
Verify Kestrel server options and reverse proxy configurations to ensure connection concurrency limits and body read timeouts are enforced.

References

Read the full report for CVE-2026-118750 on our website for more details including interactive diagrams and full exploit analysis.

CVE-2026-114155: CVE-2026-114155: Local Elevation of Privilege via TOCTOU Race Condition in Microsoft .NET dotnet-watch

CVE Reports — Wed, 11 Nov 2026 18:31:20 +0000

CVE-2026-114155: Local Elevation of Privilege via TOCTOU Race Condition in Microsoft .NET dotnet-watch

Vulnerability ID: CVE-2026-114155
CVSS Score: 7.5
Published: 2026-11-11

CVE-2026-114155 is a local elevation of privilege vulnerability affecting Microsoft .NET on Linux and macOS platforms. The vulnerability exists within the dotnet-watch (Hot Reload) component and is caused by a Time-of-Check Time-of-Use (TOCTOU) race condition (CWE-367) during the generation and execution of temporary XML solution files (.slnx) in shared system temporary directories. A local attacker with low privileges can intercept and modify the temporary solution file before MSBuild evaluates it, achieving arbitrary code execution in the security context of the user running dotnet-watch.

TL;DR

A TOCTOU race condition (CWE-367) in the Microsoft .NET dotnet-watch utility on Linux and macOS allows local attackers to overwrite temporary .slnx solution files in /tmp before MSBuild processes them, leading to local privilege escalation.

Technical Details

Vulnerability Type: CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition
Attack Vector: Local (Shared /tmp directory on Linux and macOS)
CVSS v3.1 Score: 7.5 HIGH (CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H)
Affected Component: Microsoft .NET SDK dotnet-watch (HotReloadDotNetWatcher)
Security Impact: Local Elevation of Privilege via arbitrary MSBuild code execution
Exploit Status: Unproven (No public PoC or active exploitation)
CISA KEV Status: Not Listed

Affected Systems

Microsoft .NET 10.0 on Linux
Microsoft .NET 10.0 on macOS
Microsoft .NET 11.0 on Linux
Microsoft .NET 11.0 on macOS
Microsoft.DotNet.HotReload.Watch.Aspire
Microsoft .NET 10.0 (Linux & macOS): >= 10.0.0, < 10.0.404 (Fixed in: 10.0.404)
Microsoft .NET 11.0 (Linux & macOS): >= 11.0.0-preview.1, < 11.0.100 (Fixed in: 11.0.100)
Microsoft.DotNet.HotReload.Watch.Aspire: >= 10.0.300, < 11.0.100 (Fixed in: 11.0.100)

Code Analysis

Commit: c46253a

Introduce TemporaryFileManager to securely create and lock temporary files in a user-private directory during dotnet-watch execution.

--- a/src/sdk/src/Dotnet.Watch/Watch/HotReload/HotReloadDotNetWatcher.cs
+++ b/src/sdk/src/Dotnet.Watch/Watch/HotReload/HotReloadDotNetWatcher.cs
@@ -1144,7 +1144,8 @@ async Task<bool> BuildAsync(BuildAction action, string? targetFramework, DeviceI
             }
             else if (projectPaths is not [])
             {
-                var solutionFile = Path.Combine(Path.GetTempFileName() + ".slnx");
+                // Keep the file open and allow other processes to read it (but not modify) after the content is written:
+                using var solutionFile = _context.TemporaryFileManager.Create(".slnx", FileShare.Read);
                 var solutionElement = new XElement("Solution");

                 foreach (var projectPath in projectPaths)
@@ -1153,25 +1154,11 @@ async Task<bool> BuildAsync(BuildAction action, string? targetFramework, DeviceI
                 }

                 var doc = new XDocument(solutionElement);
-                doc.Save(solutionFile);
+                doc.Save(solutionFile.Stream);

-                try
+                if (!await BuildFileOrProjectOrSolutionAsync(solutionFile.Stream.Name, targetFramework, device, action, cancellationToken))
                 {
-                    if (!await BuildFileOrProjectOrSolutionAsync(solutionFile, targetFramework, device, action, cancellationToken))
-                    {
-                        return false;
-                    }
-                }
-                finally
-                {
-                    try
-                    {
-                        File.Delete(solutionFile);
-                    }
-                    catch
-                    {
-                        // ignore
-                    }
+                    return false;
                 }
             }

Commit: 032f564

Merge pull request 66316 from msrc-temp-10.0.4xx into internal release branch.

Mitigation Strategies

Upgrade Microsoft .NET 10.0 and .NET 11.0 SDKs to the latest patched versions.
Configure per-user isolated temporary directories on Linux and macOS using the TMPDIR environment variable.
Avoid executing dotnet-watch with elevated privileges (such as root or sudo) on shared multi-user systems.
Enable Linux kernel protections for regular files in sticky world-writable directories (fs.protected_regular=2).

Remediation Steps:

Identify all Linux and macOS developer workstations and build servers with Microsoft .NET 10.0 (< 10.0.404) or .NET 11.0 (< 11.0.100) installed.
Upgrade Microsoft .NET 10.0 SDK to 10.0.404 (Runtime 10.0.15) or Microsoft .NET 11.0 SDK to 11.0.100 (Runtime 11.0.0).
Update any project dependencies on Microsoft.DotNet.HotReload.Watch.Aspire to version 11.0.100 or later.
If immediate patching is blocked, configure user profiles to export TMPDIR="$HOME/.tmp" with 0700 directory permissions.

References

Read the full report for CVE-2026-114155 on our website for more details including interactive diagrams and full exploit analysis.

CVE-2026-118748: CVE-2026-118748: Unbounded Memory Allocation Denial of Service in ASP.NET Core Blazor Static-SSR

CVE Reports — Wed, 11 Nov 2026 17:30:50 +0000

CVE-2026-118748: Unbounded Memory Allocation Denial of Service in ASP.NET Core Blazor Static-SSR

Vulnerability ID: CVE-2026-118748
CVSS Score: 7.5
Published: 2026-11-11

CVE-2026-118748 is a remote Denial of Service (DoS) vulnerability in Microsoft ASP.NET Core (.NET 11.0 preview releases prior to 11.0.0) and Microsoft Visual Studio 2026 (prior to 18.12.0). The flaw originates from unbounded resource allocation (CWE-770) within the Blazor static server-side rendering (static-SSR) validation pipeline, where dynamic or attacker-supplied form field identifiers are cached in a singleton-scoped memory structure without size limits or eviction policies. Unauthenticated remote attackers can exploit this condition over the network by sending repeated HTTP requests with unique field names, exhausting heap memory and terminating the host process via an unhandled OutOfMemoryException.

TL;DR

An unauthenticated remote attacker can trigger a Denial of Service (OutOfMemoryException) in ASP.NET Core (.NET 11.0 previews) by submitting HTTP requests with arbitrary form field names to Blazor static-SSR endpoints, causing unbounded growth in a singleton-scoped validation cache.

Technical Details

CVE ID: CVE-2026-118748
Weakness Class: CWE-770 (Allocation of Resources Without Limits or Throttling)
Affected Component: ASP.NET Core Blazor Static-SSR Client-Side Validation Cache
Attack Vector: Network (Unauthenticated HTTP Form Submissions)
CVSS v3.1 Score: 7.5 HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Primary Impact: Remote Denial of Service via Heap Exhaustion (OutOfMemoryException)
Exploit Status: Unproven (No Public PoC)
CISA KEV Status: Not Listed

Affected Systems

Microsoft .NET 11.0 (Linux, macOS, Windows)
Microsoft ASP.NET Core 11.0 (Blazor static-SSR)
Microsoft Visual Studio 2026 (Windows)
.NET 11.0 (Linux, macOS, Windows): >= 11.0.0-preview.1, < 11.0.0 (Fixed in: 11.0.0)
Microsoft Visual Studio 2026: < 18.12.0 (Fixed in: 18.12.0)

Mitigation Strategies

Upgrade the .NET Runtime and ASP.NET Core shared framework to the general availability release 11.0.0 or later.
Restrict per-request form parameter counts and key lengths using ASP.NET Core FormOptions (ValueCountLimit and KeyLengthLimit).
Apply strict rate limiting on HTTP POST endpoints utilizing Blazor static server-side rendering (static-SSR).
Ensure internal or custom validation caches bind metadata to request lifetimes (Scoped) or use bounded MemoryCache instances with explicit SizeLimit and TTL configurations.

Remediation Steps:

Inventory all hosts, containers, and build agents running .NET 11.0 preview builds (< 11.0.0) or Visual Studio 2026 (< 18.12.0) via dotnet --list-runtimes.
Download and install the official .NET 11.0.0 SDK and ASP.NET Core Runtime packages from Microsoft's official distribution channels.
Update Visual Studio 2026 installations to version 18.12.0 or later via the Visual Studio Installer.
Rebuild and redeploy any self-contained ASP.NET Core deployments (--self-contained true) so the patched framework assemblies are bundled into the application artifacts.
Verify the runtime version in production environments and monitor .NET Gen 2 heap size metrics (dotnet-counters monitor --counters System.Runtime) to confirm memory stability.

References

Read the full report for CVE-2026-118748 on our website for more details including interactive diagrams and full exploit analysis.

CVE-2026-114150: CVE-2026-114150: Remote Information Disclosure via Uninitialized Pooled Memory in ASP.NET Core Response…

CVE Reports — Wed, 11 Nov 2026 16:30:50 +0000

CVE-2026-114150: Remote Information Disclosure via Uninitialized Pooled Memory in ASP.NET Core Response Buffering

Vulnerability ID: CVE-2026-114150
CVSS Score: 5.9
Published: 2026-11-11

CVE-2026-114150 is a network-accessible information disclosure vulnerability affecting Microsoft ASP.NET Core in .NET 11.0 preview releases and Microsoft Visual Studio 2026 prior to version 18.12.0. The flaw stems from the use of uninitialized resources (CWE-908) within response buffering components, specifically ResponseBufferingStream used by middleware such as HTTP Logging and Output Caching. Because rented memory segments from ArrayPool or MemoryPool are not cleared upon return or strictly bounded to the exact written byte count during subsequent reads, residual response payloads from earlier HTTP requests remain in the buffer tail. Downstream consumers or log sinks reading these buffers expose confidential cross-session data, including authentication tokens and personally identifiable information.

TL;DR

An uninitialized memory reuse flaw (CWE-908) in ASP.NET Core 11.0 preview response buffering middleware allows residual HTTP response data from pooled memory buffers to leak into subsequent short responses or application log sinks. Upgrading to .NET 11.0.0 GA or Visual Studio 2026 18.12.0 resolves the issue.

Technical Details

CVE ID: CVE-2026-114150
Weakness Class: CWE-908 (Use of Uninitialized Resource)
CVSS v3.1 Score: 5.9 Medium (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N)
Attack Vector: Network (HTTP/HTTPS Response Buffering)
Primary Impact: High Confidentiality Loss (Cross-Request Memory & Log Disclosure)
Affected Component: ASP.NET Core ResponseBufferingStream / HttpLogging & OutputCaching
Exploit Status: Unproven / No Public PoC
CISA KEV Status: Not Listed

Affected Systems

Microsoft .NET 11.0 (Linux, macOS, Windows)
Microsoft ASP.NET Core 11.0 Preview Builds
Microsoft Visual Studio 2026 (Version 18.12)
.NET 11.0 (Linux, macOS, Windows): >= 11.0.0-preview.1, < 11.0.0 (Fixed in: 11.0.0)
Visual Studio 2026: < 18.12.0 (Fixed in: 18.12.0)

Mitigation Strategies

Upgrade all .NET 11.0 preview installations (.NET 11.0.0-preview.1 through RC builds) to the official .NET 11.0.0 General Availability (GA) release.
Update Microsoft Visual Studio 2026 development environments to version 18.12.0 or later.
Disable HTTP response body logging in HttpLoggingMiddleware by removing HttpLoggingFields.ResponseBody and avoiding HttpLoggingFields.All in application startup configurations.
Audit custom Stream and IHttpResponseBodyFeature implementations to ensure all ArrayPool and MemoryPool rentals are strictly sliced to actual written byte counts and cleared upon return.

Remediation Steps:

Inventory all servers, virtual machines, and container images running Microsoft.AspNetCore.App versions matching 11.0.0-preview.*
Download and install the .NET 11.0.0 GA runtime, ASP.NET Core Hosting Bundle, or SDK from Microsoft's official distribution channels.
Rebuild and redeploy containerized ASP.NET Core applications using the patched mcr.microsoft.com/dotnet/aspnet:11.0 base image.
Update Microsoft Visual Studio 2026 to version 18.12.0 on all developer workstations and CI/CD build nodes.
Inspect historical application logs generated by affected preview builds and purge or rotate any credentials, API keys, or session tokens that may have leaked into trailing log entries.

References

Read the full report for CVE-2026-114150 on our website for more details including interactive diagrams and full exploit analysis.

CVE-2026-114146: CVE-2026-114146: Elevation of Privilege in ASP.NET Core SignalR Connection Dispatcher

CVE Reports — Wed, 11 Nov 2026 15:31:22 +0000

CVE-2026-114146: Elevation of Privilege in ASP.NET Core SignalR Connection Dispatcher

Vulnerability ID: CVE-2026-114146
CVSS Score: 9.0
Published: 2026-11-11

An incorrect authorization vulnerability (CWE-863) exists in the ASP.NET Core SignalR HTTP Connection Dispatcher (Microsoft.AspNetCore.Http.Connections). The connection negotiation process failed to bind the authenticated caller identity to the generated connection state, and subsequent transport or message dispatch handlers failed to verify caller consistency. Consequently, an authenticated low-privilege attacker who obtains a valid connection identifier or token can inject messages into or hijack another user's SignalR session, achieving an elevation of privilege across security boundaries.

TL;DR

CVE-2026-114146 is a critical (CVSS 9.0) elevation of privilege vulnerability in ASP.NET Core (Microsoft.AspNetCore.Http.Connections). Because HttpConnectionDispatcher did not bind or verify the ClaimsPrincipal across the SignalR negotiation, transport initiation, and message transmission phases, an authenticated attacker possessing a victim's connection token can hijack their connection or inject arbitrary hub invocations under the victim's identity.

⚠️ Exploit Status: POC

Technical Details

Vulnerability Type: CWE-863: Incorrect Authorization
Affected Component: Microsoft.AspNetCore.Http.Connections (HttpConnectionDispatcher)
Attack Vector: Network (Authenticated SignalR HTTP Endpoints)
CVSS v3.1 Score: 9.0 Critical (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H)
Security Impact: Elevation of Privilege / Cross-User SignalR Session Hijacking
Exploit Status: Proof-of-Concept in Public Test Suite (No Weaponized Exploits)
CISA KEV Status: Not Listed

Affected Systems

Microsoft .NET 8.0
Microsoft .NET 9.0
Microsoft .NET 10.0
Microsoft .NET 11.0
Microsoft.AspNetCore.Http.Connections
Microsoft Visual Studio 2022
Microsoft Visual Studio 2026
.NET 8.0: >= 8.0.0, < 8.0.34 (Fixed in: 8.0.34)
.NET 9.0: >= 9.0.0, < 9.0.23 (Fixed in: 9.0.23)
.NET 10.0: >= 10.0.0, < 10.0.15 (Fixed in: 10.0.15)
.NET 11.0: >= 11.0.0-preview.1, < 11.0.0 (Fixed in: 11.0.0)
Microsoft.AspNetCore.Http.Connections: >= 1.2.0, < 1.2.14 (Fixed in: 1.2.14)
Microsoft Visual Studio 2022: >= 17.14.0, < 17.14.45 (Fixed in: 17.14.45)
Microsoft Visual Studio 2026: >= 18.11.0, < 18.11.4 (Fixed in: 18.11.4)

Code Analysis

Commit: 514c860

Bind negotiated user identity to HttpConnectionContext and reject mismatched callers in HttpConnectionDispatcher (PR 66942)

Commit: db85798

Servicing backport for SignalR HttpConnectionDispatcher user identity binding (PR 66953)

Commit: e1ae50f

Servicing backport for SignalR HttpConnectionDispatcher user identity binding (PR 66952)

Exploit Details

GitHub: Unit-level proof-of-concept tests included in the official fix commit (HttpConnectionDispatcherTests.ConnectionBinding.cs) demonstrating cross-user connection hijacking and message injection.

Mitigation Strategies

Upgrade the ASP.NET Core Shared Runtime and .NET SDK on all build agents and production hosts to the latest servicing release.
Rebuild and redeploy self-contained .NET applications so they incorporate the updated Microsoft.AspNetCore.Http.Connections assembly.
Restrict SignalR endpoints to use the WebSockets transport exclusively (HttpTransportType.WebSockets) to eliminate separate HTTP POST /send and Long Polling requests.
Protect SignalR query parameters (?id=) from exposure in reverse proxy logs, APM telemetry, and browser referer headers.

Remediation Steps:

Identify all servers, containers, and serverless functions running .NET 8.0, 9.0, 10.0, or 11.0-preview, or referencing Microsoft.AspNetCore.Http.Connections.
Install the patched ASP.NET Core Runtime: 8.0.34 for .NET 8, 9.0.23 for .NET 9, or 10.0.15 for .NET 10.
Update any explicit PackageReference for Microsoft.AspNetCore.Http.Connections to version 1.2.14 or higher and recompile the application.
Restart the hosting processes (IIS application pools, Kestrel systemd services, or container pods) and monitor application logs for EventId 26 (UserNameChanged) indicating rejected cross-user requests.

References

Read the full report for CVE-2026-114146 on our website for more details including interactive diagrams and full exploit analysis.