CVE-2026-58649

Overview

.NET is a free, open-source, cross-platform framework for building modern apps and powerful cloud services. It consists of a runtime and a developer platform made up of tools, programming languages, and libraries for building many different types of applications.

An information disclosure vulnerability (CVE-2026-58649) has been identified in the dotnet watch browser refresh server that ships with the .NET SDK. The WebSocket endpoint that pushes hot reload updates to the browser accepted a connection upgrade from any origin, so a page on an attacker-controlled site visited by a developer could connect to the refresh server running on that developer's machine and read the payloads sent over it.

Per CWE-346: Origin Validation Error, the weakness is a product not correctly verifying that data or communication comes from a valid source.

This affects developer machines rather than deployed applications: the refresh server runs only while dotnet watch is running, so production hosts and published applications are not exposed. The developer must both be running dotnet watch and visit the attacker's page in the same browser session, which is why the vector carries a user interaction requirement. The issue affects the tool bundled with .NET SDK 6.0.0 through the NES for .NET 6.0.45 release. Microsoft serviced its supported SDK lines on September 8, 2026 and never published a fix for the 6.0 SDK line, because .NET 6 is End-of-Life.

Details

Module Info

• Product: .NET SDK
• Affected packages: dotnet-watch (bundled in the .NET SDK under DotnetTools/, not an opt-in package)
• Affected versions: .NET SDK >=6.0.0 <=6.0.45
• Package manager: NuGet, Windows Installer, Docker
• GitHub repository: https://github.com/dotnet/sdk
• Published packages: Download .NET
• Fixed in:
  
  • NES for .NET 6.0.46

Vulnerability Info

This Medium-severity vulnerability is found in BrowserRefreshServer, the component of the dotnet watch tool that serves hot reload notifications to a browser over a WebSocket.

When dotnet watch starts, it opens a local HTTP listener and hands the browser a script that connects back over a WebSocket. On receiving an upgrade request the server accepted the socket after checking only that the request was a WebSocket upgrade, without comparing the request's Origin header against the local host it expected. Any page in the developer's browser could therefore open that socket, because the browser attaches no same-origin restriction to WebSocket handshakes. Once connected, the attacker's page receives what the server pushes: the intermediate language and program database payloads for the code being edited, which disclose source-derived detail about the application under development.

The remediation validates the Origin header on the upgrade request against an allow list of local hosts and rejects anything else, with the allow list overridable through the DOTNET_WATCH_AUTO_RELOAD_WS_ORIGINS environment variable for setups that legitimately serve the browser from another host.

This vulnerability has been present since at least .NET SDK 6.0 and likely earlier.

Mitigation

.NET 6 is End-of-Life and will not receive any updates from Microsoft to address this issue. For more information see .NET and .NET Core official support policy.

Users of the affected components should apply one of the following mitigations:

• Upgrade affected applications to one of: .NET SDK >=8.0.130 or >=8.0.424, .NET SDK >=9.0.120 or >=9.0.317, .NET SDK >=10.0.111 or >=10.0.400.
• Avoid browsing untrusted sites while dotnet watch is running, until patched.
• Leverage a commercial support partner like HeroDevs for post-EOL security support, including NES for .NET 6.0.46 or later.