CVE-2026-120006

Name of the Vulnerable Software and Affected Versions Aspire.Hosting.AppHost versions prior to 13.6.5 Aspire.Hosting versions prior to 13.6.5

Description Insertion of sensitive information into sent data allows an authorized attacker to elevate privileges locally. Specifically, an Aspire Dashboard authentication cookie can be disclosed to a linked service, enabling an attacker-controlled container to replay the authenticated session and execute code as the host developer. This occurs in a Dashboard-authenticated AppHost workflow involving an attacker-controlled container and a linked HTTPS YARP gateway.

Recommendations Update Aspire.Hosting.AppHost to version 13.6.5 or later. Update Aspire.Hosting to version 13.6.5 or later. Update Aspire.AppHost.Sdk to version 13.6.5 or later if the package is obtained implicitly.