CVE-2026-70179

Overview

.NET is a free, open-source, cross-platform framework for building modern apps and powerful cloud services. It consists of a runtime and a developer platform made up of tools, programming languages, and libraries for building many different types of applications.

An elevation of privilege vulnerability (CVE-2026-70179) has been identified in ASP.NET Core's Negotiate (Kerberos) authentication handler. With LDAP claim resolution turned on, the handler can attach role claims from the wrong directory account to an authenticated user, because it does not confirm that the LDAP entry it found is the account Kerberos authenticated. A user could gain another account's roles.

Per CWE-290: Authentication Bypass by Spoofing, the weakness is an authentication scheme that is incorrectly implemented, allowing an attacker to bypass it by spoofing.

This issue only affects ASP.NET Core 6.0 applications that use the Microsoft.AspNetCore.Authentication.Negotiate package with LDAP claim resolution enabled through EnableLdap, on Windows, Linux, and macOS. Applications that do not enable LDAP claim resolution are not affected. The fix ships in the package, not the shared framework, so applications must update the package reference. Microsoft's advisory lists Microsoft.AspNetCore.Authentication.Negotiate 8.0, 9.0 and 10.0 as affected; .NET 6 is past end of life and is not assessed there.

Details

Module Info

• Product: Any NES for .NET 6 ASP.NET Core application using Microsoft.AspNetCore.Authentication.Negotiate 6.0.46 or earlier with LDAP claim resolution enabled.
• Affected packages: Microsoft.AspNetCore.Authentication.Negotiate (opt-in package, not in the shared framework)
• Affected versions:
  
  • Microsoft.AspNetCore.Authentication.Negotiate >= 6.0.0 <= 6.0.46
• Package manager: NuGet
• GitHub repository: https://github.com/dotnet/aspnetcore
• Published packages: Microsoft.AspNetCore.Authentication.Negotiate on NuGet
• Fixed in: NES for .NET 6.0.47

Vulnerability Info

This High-severity vulnerability is found in the LDAP claim resolution of Microsoft.AspNetCore.Authentication.Negotiate.

After Kerberos authenticates a user, the handler can look the user up in the directory over LDAP and add each group the entry belongs to as a role claim. It searched by account name (sAMAccountName) and trusted whatever entry came back. If that name resolved to a different directory object than the Kerberos principal, the caller received that object's roles. Results were also cached by name alone.

The fix compares the LDAP entry's objectSid with the authenticated identity's PrimarySid claim and adds no LDAP claims when they differ; the claims cache is keyed by SID as well. Only Windows identities carry PrimarySid, so the check runs by default on Windows hosts. On Linux and macOS, identities have no PrimarySid. There, the new AppContext switch Microsoft.AspNetCore.Authentication.Negotiate.RequirePrimarySidClaim makes the handler skip LDAP claims for identities without a SID instead of trusting the name. This matches Microsoft's fix for supported releases.

This vulnerability has been present since at least ASP.NET Core 6.0 and likely earlier.

Mitigation

.NET 6 is End-of-Life and will not receive any updates to address this issue. For more information see .NET and .NET Core official support policy.

Users of the affected components should apply one of the following mitigations:

• Upgrade affected applications to one of:
  
  • NES for .NET Microsoft.AspNetCore.Authentication.Negotiate 6.0.47 or later
  • .NET / ASP.NET Core 8.0.32 or later
  • .NET / ASP.NET Core 9.0.21 or later
  • .NET / ASP.NET Core 10.0.13 or later
• On Linux and macOS, review whether to set RequirePrimarySidClaim after upgrading. It closes the name-based fallback, but it also stops LDAP role claims for identities that carry no SID.
• Leverage a commercial support partner like HeroDevs for post-EOL security support, including NES for .NET 6.0.47 or later.

Credits

thegoldmandm, as credited in Microsoft's advisory.