CVE-2026-47300

Overview

.NET is a free, open-source, cross-platform framework for building modern apps and powerful cloud services. It consists of a runtime and a developer platform made up of tools, programming languages, and libraries for building many different types of applications. ASP.NET Core extends the .NET developer platform with tools and libraries specifically for building web apps. ASP.NET Core is the open-source version of ASP.NET, that runs on macOS, Linux, and Windows. ASP.NET Core was first released in 2016 and is a re-design of earlier Windows-only versions of ASP.NET.

A vulnerability (CVE-2026-47300) exists in the Negotiate authentication handler of ASP.NET Core, specifically in the LDAP role-claim resolution provided by the opt-in Microsoft.AspNetCore.Authentication.Negotiate package. When an application enables LDAP-backed role claims, the internal LdapAdapter builds an LDAP search filter from the authenticated principal name without validating the Kerberos realm and without escaping LDAP special characters. This can allow a remote attacker who presents a bare or foreign-realm Kerberos principal whose local account name matches a privileged account in the configured domain to inherit that account's group memberships as role claims, resulting in elevation of privilege. Principal names that contain LDAP filter metacharacters can additionally alter the structure of the search filter, a form of LDAP injection.

Per CWE-303: Incorrect Implementation of Authentication Algorithm, the requirements for the product dictate the use of an established authentication algorithm, but the implementation of the algorithm is incorrect.

This issue affects ASP.NET Core 6.0.0 <= 6.0.42 in NES-supported environments. The vulnerable code ships only in the opt-in Microsoft.AspNetCore.Authentication.Negotiate NuGet package and is reached only when LDAP role-claim resolution is enabled, so the shared ASP.NET Core framework alone neither delivers nor remediates it and affected applications must update the package reference. 

‍

Details

Module Info

• Product:
  
  • Any ASP.NET Core 6.0 application that references Microsoft.AspNetCore.Authentication.Negotiate 6.0.42 or earlier and enables LDAP role-claim resolution.
• Affected packages:
  
  • Microsoft.AspNetCore.Authentication.Negotiate
• Affected versions:
  
  • >= 6.0.0 <= 6.0.42
• GitHub repository: https://github.com/dotnet/aspnetcore
• Published packages: Download .NET (Linux, macOS, and Windows)
• Package manager:
  
  • NuGet
• Fixed in: NES for .NET 6.0.43

Vulnerability Info

This High-severity vulnerability is found in the Microsoft.AspNetCore.Authentication.Negotiate package used with ASP.NET Core Negotiate authentication. When an application enables LDAP role-claim resolution, for example through NegotiateOptions.EnableLdap with a configured LdapSettings.Domain, the LdapAdapter takes the authenticated principal name and derives the account name used to look up group memberships in the configured directory. Two problems combine in this code path. First, the Kerberos realm is stripped without any validation, so a bare principal such as admin, or a foreign-realm principal such as admin@EVIL.REALM, is resolved against a same-named account in the configured domain and that account's group memberships are attached to the caller as role claims. Second, the derived account name is interpolated verbatim into the sAMAccountName search filter with no RFC 4515 escaping, so principal text containing LDAP filter metacharacters can change the meaning of the query.

var user = identity.Name!;
var userAccountNameIndex = user.IndexOf('@');
var userAccountName = userAccountNameIndex == -1 ? user : user.Substring(0, userAccountNameIndex);
...
var filter = $"(&(objectClass=user)(sAMAccountName={userAccountName}))";

This vulnerability was introduced in 2020 with ASP.NET Core 5.0.

‍

Mitigation

ASP.NET Core 6 is End-of-Life and will not receive any updates to address this issue. For more information see .NET and .NET Core official support policy.

Users of the affected components should apply one of the following mitigations:

• Upgrade affected applications to one of:
  
  • Microsoft.AspNetCore.Authentication.Negotiate >= 8.0.29
  • Microsoft.AspNetCore.Authentication.Negotiate >= 9.0.18
  • Microsoft.AspNetCore.Authentication.Negotiate >= 10.0.10
• Leverage a commercial support partner like HeroDevs for post-EOL security support, including NES for .NET 6.0.43 or later.

‍

Credits

Microsoft credits Artur Stetsko for reporting this vulnerability.