Insecure temporary files can expose sensitive configuration information to a local attacker on Linux or macOS.Microsoft assigns a CVSS 3.1 score of 7.3 High and rates the issue Important. The flaw affects the deprecated MCP configuration scanner included with specific Aspire CLI packages.
What it allows
How Can CVE-2026-120792 Expose Aspire Data?
The affected component is the Aspire CLI's deprecated MCP configuration scanner. Its diagnostics can place configuration content in temporary files at a fixed path within a shared temporary directory.
The reported scenario requires an affected CLI on a non-Windows system where multiple users share the temporary directory. A local attacker needs low privileges, and the CVSS vector records required user interaction.
Successful exploitation can disclose sensitive configuration information. Microsoft's vector also records low integrity and availability impacts, while confidentiality impact is high.
The CVE was not in CISA's Known Exploited Vulnerabilities catalog version 2026.11.10. The available primary records do not establish whether exploitation has occurred.
Who is affected
Which Aspire CLI Versions Are Affected by CVE-2026-120792?
Standalone Aspire.Cli versions 13.2.0 through 13.6.4 are affected. Platform-specific NuGet packages for Linux and macOS are affected from 13.3.0 through 13.6.4.
The main and platform-specific npm packages are affected from version 13.4.2 through 13.6.4. The listed platforms are Linux and macOS on x64 and Arm64 architectures.
Version 13.6.5 fixes every package range listed in the Microsoft advisory. Updating a .NET runtime or SDK alone does not establish that the independently shipped Aspire CLI was updated.
Timeline
- 2026-11-10
Microsoft published its Aspire CLI advisory and released version 13.6.5 as the fixed version.
- 2026-11-10
NVD published CVE-2026-120792 with Microsoft's CVSS 3.1 score of 7.3 High.
- 2026-11-11
GitHub reviewed and updated the advisory record for CVE-2026-120792.
What to do
-
Update Aspire CLI to 13.6.5 or later
Use the installation method that originally deployed the CLI. Confirm both the main package and any platform-specific dependency resolve to version 13.6.5 or later.
-
Inventory Linux and macOS installations
Find standalone, .NET tool, and npm installations of Aspire CLI. Check the CLI version directly instead of relying on the installed .NET runtime or SDK version.
-
Prioritize shared development systems
Prioritize affected hosts where multiple users share a temporary directory. Microsoft identifies that environment as a prerequisite for the reported scenario.
-
Review temporary-file exposure
Brandefense recommends checking affected hosts for Aspire CLI temporary diagnostics and possible unauthorized access. Handle any recovered configuration content as sensitive material.
-
Rotate exposed secrets when evidence supports it
Brandefense recommends rotating credentials or tokens found in exposed configuration data. Investigate their use before closing the incident.
What Brandefense can do
- Scan your domain in Brandefense Atlas, free
Atlas checks public sources for leaked credentials, phishing domains, dark web mentions and data sales, then gives your domain a risk grade. Free, no sign-up.
- Vulnerability Intelligence
Brandefense Vulnerability Intelligence follows which vulnerabilities attackers are using, so your team can patch what is under attack first.
Frequently Asked Questions
What is CVE-2026-120792?
It is an information disclosure vulnerability in the Microsoft Aspire CLI. Insecure temporary diagnostics can expose sensitive configuration information to a local attacker.
Which systems are exposed to CVE-2026-120792?
The reported scenario affects Linux or macOS systems running vulnerable Aspire CLI versions when multiple users share a temporary directory.
Which version fixes CVE-2026-120792?
Microsoft lists Aspire CLI 13.6.5 as the fixed version for every affected standalone, NuGet, and npm package range.
Does updating .NET fix CVE-2026-120792?
Not necessarily. Microsoft says Aspire ships independently of .NET, so administrators must verify and update the Aspire CLI itself.
Is CVE-2026-120792 actively exploited?
The available primary records do not establish exploitation. The CVE was not in CISA KEV catalog version 2026.11.10.
Sources
- Microsoft Security Advisory CVE-2026-120792Microsoft
- CVE-2026-120792 DetailNational Vulnerability Database
- Known Exploited Vulnerabilities CatalogCybersecurity and Infrastructure Security Agency
