Loading vulnerability…
ASP.NET Core Path Canonicalization Authorization Bypass
CVE-2026-114156 is a security feature bypass vulnerability in ASP.NET Core involving inconsistent path canonicalization between PathString.StartsWithSegments checks and downstream request handling. A literal or percent-encoded backslash can cause a request to fail a protected-prefix check, skipping authorization middleware, while a later component normalizes the backslash into a forward slash and dispatches the request to the protected resource. The identified affected range is .NET 11 prerelease versions from 11.0.0-preview.1 up to, but excluding, 11.0.0. Exploitation is conditional on application configuration and downstream normalization behavior.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation allows an unauthenticated remote attacker to bypass path-based authorization and access protected application functionality. Depending on the affected endpoint, this can expose restricted information or permit unauthorized modifications. The CVSS v3.1 assessment assigns low confidentiality impact, high integrity impact, and no availability impact, with a base score of 6.5.
If you can’t patch tonight, do this now.
Replace prefix-only authorization middleware with endpoint-bound authorization using RequireAuthorization() or [Authorize], ensuring protected endpoints enforce the required policy independently of early path interpretation. As defense in depth, reject percent-encoded backslashes at the reverse proxy or application boundary before authorization and routing. Filtering alone should not be treated as a substitute for installing the fixed runtime.
Patch, then assume compromise.
Install ASP.NET Core runtime 11.0.0 or later and update independently referenced affected runtime packages to 11.0.0 or later. Restart affected applications after updating. Rebuild and redeploy self-contained applications with the fixed runtime, because a machine-wide runtime update does not replace embedded runtimes. An SDK update alone does not update independently referenced application packages. For Red Hat deployments, apply the applicable .NET 11 security updates, including RHSA-2026:99054 for RHEL 8 or RHSA-2026:99137 for RHEL 10.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
10 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.