Inclusion of Sensitive Information in Log Files in Aspire.Cli - CVE-2026-120792
Published: November 11, 2026
Vulnerability identifier: #VU165431
CSH Severity: Medium
CVSS v4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-120792
CWE-ID: CWE-532
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local user to disclose another user's configuration information, including credentials stored in that configuration.
The vulnerability exists due to insertion of sensitive information into log files in .NET Aspire's diagnostic logging when recording configuration information. A local user can read exposed diagnostic logs on a shared computer to obtain another user's configuration information and stored credentials.
Affected software
Aspire.Cli
How to mitigate CVE-2026-120792
Install security update from vendor's website.
Aspire.Cli - update to 13.6.5