CVE-2026-114146

Name of the Vulnerable Software and Affected Versions Microsoft.AspNetCore.Http.Connections versions 1.2.0 through 1.2.13 Microsoft.AspNetCore.App.Runtime versions 8.0.0-preview.1.23112.2 through 8.0.33 Microsoft.AspNetCore.App.Runtime versions 9.0.0-preview.1.24081.5 through 9.0.22 Microsoft.AspNetCore.App.Runtime versions 10.0.0-preview.1.25120.3 through 10.0.14 Microsoft.AspNetCore.App.Runtime versions 11.0.0-preview.1.26104.118 through 11.0.0-rc.3.26522.148

Description Incorrect authorization in ASP.NET Core allows an authorized attacker to elevate privileges over a network. SignalR connections are not consistently bound to the identity negotiated at connection establishment, which enables injected messages to execute Hub invocations as the victim.

Recommendations Update Microsoft.AspNetCore.Http.Connections to version 1.2.14. Update Microsoft.AspNetCore.App.Runtime to version 8.0.34. Update Microsoft.AspNetCore.App.Runtime to version 9.0.23. Update Microsoft.AspNetCore.App.Runtime to version 10.0.15. Update Microsoft.AspNetCore.App.Runtime to version 11.0.0.