CVE-2026-118740: Missing Authorization in Microsoft Aspire Dashboard Blazor Router

Vulnerability ID: CVE-2026-118740
CVSS Score: 9.1
Published: 2026-11-12

CVE-2026-118740 is a Missing Authorization (CWE-862) vulnerability in the Microsoft Aspire Dashboard and Aspire.Dashboard.Sdk.linux-x64 packages. In versions 13.6.1 prior to 13.6.5, an architectural flaw in the Blazor routing configuration (Routes.razor) causes unmapped (404 / Not-Found) routes to bypass the AuthorizeRouteView component. By navigating to an arbitrary non-existent route, an unauthenticated remote attacker forces the application into the NotFound template, which unconditionally renders the primary MainLayout component and initializes global user interface services, interaction providers, and underlying SignalR/Blazor circuits without verifying authentication credentials.

TL;DR

An unauthenticated security feature bypass in Microsoft Aspire Dashboard (versions 13.6.1 through 13.6.4) allows remote attackers to initialize protected dashboard layouts and backend Blazor interactive circuits by requesting any non-existent URL path. Upgrading to Aspire 13.6.5 resolves the issue by enforcing authorization policies across both matched and unmatched routes and introducing lifecycle authentication guards.

⚠️ Exploit Status: POC

Technical Details

  • CVE ID: CVE-2026-118740
  • Weakness: CWE-862 (Missing Authorization)
  • CVSS v3.1 Score: 9.1 Critical (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N)
  • EPSS Score: 0.92% (60.87th Percentile)
  • Attack Vector: Network (Unauthenticated HTTP / Blazor Route Navigation)
  • Impact: Security Feature Bypass (Unauthorized Layout & Circuit Initialization)
  • Exploit Status: Proof-of-Concept (Playwright Integration Test)
  • CISA KEV Status: Not Listed

Affected Systems

  • Microsoft Aspire Dashboard
  • Aspire.Dashboard.Sdk.linux-x64
  • Aspire Dashboard: >= 13.6.1, < 13.6.5 (Fixed in: 13.6.5)
  • Aspire.Dashboard.Sdk.linux-x64: >= 13.6.1, < 13.6.5 (Fixed in: 13.6.5)

Code Analysis

Commit: 0b6bfe2

[release/13.6] Fix dashboard not-found authentication (PR 66656)

Commit: f017f66

Restrict container tunnels strictly to OTLP endpoints (PR 68055)

Mitigation Strategies

  • Upgrade Microsoft Aspire Dashboard and associated SDK packages to version 13.6.5 or later.
  • Place the Aspire Dashboard behind an authenticating reverse proxy (e.g., YARP, NGINX, Azure Application Gateway) to enforce authentication prior to request routing.
  • Bind the Aspire Dashboard frontend strictly to localhost (127.0.0.1) or isolate it within restricted management networks.

Remediation Steps:

  1. Update .NET Aspire workloads and NuGet package references (including Aspire.Dashboard.Sdk.linux-x64) to version 13.6.5 or higher.
  2. Rebuild and redeploy all Aspire AppHost and standalone Aspire Dashboard container images.
  3. Verify the fix by navigating to an arbitrary non-existent route (e.g., /nonexistent) in an unauthenticated browser session and confirming an immediate redirect to /login?returnUrl=%2Fnonexistent.

References

Read the full report for CVE-2026-118740 on our website for more details including interactive diagrams and full exploit analysis.