CVE-2026-114146: Elevation of Privilege in ASP.NET Core SignalR Connection Dispatcher

Vulnerability ID: CVE-2026-114146
CVSS Score: 9.0
Published: 2026-11-11

An incorrect authorization vulnerability (CWE-863) exists in the ASP.NET Core SignalR HTTP Connection Dispatcher (Microsoft.AspNetCore.Http.Connections). The connection negotiation process failed to bind the authenticated caller identity to the generated connection state, and subsequent transport or message dispatch handlers failed to verify caller consistency. Consequently, an authenticated low-privilege attacker who obtains a valid connection identifier or token can inject messages into or hijack another user's SignalR session, achieving an elevation of privilege across security boundaries.

TL;DR

CVE-2026-114146 is a critical (CVSS 9.0) elevation of privilege vulnerability in ASP.NET Core (Microsoft.AspNetCore.Http.Connections). Because HttpConnectionDispatcher did not bind or verify the ClaimsPrincipal across the SignalR negotiation, transport initiation, and message transmission phases, an authenticated attacker possessing a victim's connection token can hijack their connection or inject arbitrary hub invocations under the victim's identity.

⚠️ Exploit Status: POC

Technical Details

• Vulnerability Type: CWE-863: Incorrect Authorization
• Affected Component: Microsoft.AspNetCore.Http.Connections (HttpConnectionDispatcher)
• Attack Vector: Network (Authenticated SignalR HTTP Endpoints)
• CVSS v3.1 Score: 9.0 Critical (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H)
• Security Impact: Elevation of Privilege / Cross-User SignalR Session Hijacking
• Exploit Status: Proof-of-Concept in Public Test Suite (No Weaponized Exploits)
• CISA KEV Status: Not Listed

Affected Systems

• Microsoft .NET 8.0
• Microsoft .NET 9.0
• Microsoft .NET 10.0
• Microsoft .NET 11.0
• Microsoft.AspNetCore.Http.Connections
• Microsoft Visual Studio 2022
• Microsoft Visual Studio 2026
• .NET 8.0: >= 8.0.0, < 8.0.34 (Fixed in: 8.0.34)
• .NET 9.0: >= 9.0.0, < 9.0.23 (Fixed in: 9.0.23)
• .NET 10.0: >= 10.0.0, < 10.0.15 (Fixed in: 10.0.15)
• .NET 11.0: >= 11.0.0-preview.1, < 11.0.0 (Fixed in: 11.0.0)
• Microsoft.AspNetCore.Http.Connections: >= 1.2.0, < 1.2.14 (Fixed in: 1.2.14)
• Microsoft Visual Studio 2022: >= 17.14.0, < 17.14.45 (Fixed in: 17.14.45)
• Microsoft Visual Studio 2026: >= 18.11.0, < 18.11.4 (Fixed in: 18.11.4)

Code Analysis

Commit: 514c860

Bind negotiated user identity to HttpConnectionContext and reject mismatched callers in HttpConnectionDispatcher (PR 66942)

Commit: db85798

Servicing backport for SignalR HttpConnectionDispatcher user identity binding (PR 66953)

Commit: e1ae50f

Servicing backport for SignalR HttpConnectionDispatcher user identity binding (PR 66952)

Exploit Details

• GitHub: Unit-level proof-of-concept tests included in the official fix commit (HttpConnectionDispatcherTests.ConnectionBinding.cs) demonstrating cross-user connection hijacking and message injection.

Mitigation Strategies

• Upgrade the ASP.NET Core Shared Runtime and .NET SDK on all build agents and production hosts to the latest servicing release.
• Rebuild and redeploy self-contained .NET applications so they incorporate the updated Microsoft.AspNetCore.Http.Connections assembly.
• Restrict SignalR endpoints to use the WebSockets transport exclusively (HttpTransportType.WebSockets) to eliminate separate HTTP POST /send and Long Polling requests.
• Protect SignalR query parameters (?id=) from exposure in reverse proxy logs, APM telemetry, and browser referer headers.

Remediation Steps:

1. Identify all servers, containers, and serverless functions running .NET 8.0, 9.0, 10.0, or 11.0-preview, or referencing Microsoft.AspNetCore.Http.Connections.
2. Install the patched ASP.NET Core Runtime: 8.0.34 for .NET 8, 9.0.23 for .NET 9, or 10.0.15 for .NET 10.
3. Update any explicit PackageReference for Microsoft.AspNetCore.Http.Connections to version 1.2.14 or higher and recompile the application.
4. Restart the hosting processes (IIS application pools, Kestrel systemd services, or container pods) and monitor application logs for EventId 26 (UserNameChanged) indicating rejected cross-user requests.

References

• Microsoft Security Response Center (MSRC) Advisory: CVE-2026-114146
• Official CVE Record: CVE-2026-114146
• GitHub Fix Commit 514c86030195fd6b649bb26c48975a043d96b791 (PR 66942)
• GitHub Fix Commit db8579880b30153dbd601fa079f49e7e3ce42e08 (PR 66953)
• GitHub Fix Commit e1ae50f427a49c76528376a5b3af8216bfda55bc (PR 66952)
• ASP.NET Core v10.0.15 Release
• ASP.NET Core v9.0.23 Release
• ASP.NET Core v8.0.34 Release
• CISA Known Exploited Vulnerabilities Catalog

Read the full report for CVE-2026-114146 on our website for more details including interactive diagrams and full exploit analysis.