CVE-2026-114156: Path Equivalence Security Feature Bypass in Microsoft ASP.NET Core

Vulnerability ID: CVE-2026-114156
CVSS Score: 6.5
Published: 2026-11-11

CVE-2026-114156 is an improper resolution of path equivalence vulnerability (CWE-41) in Microsoft ASP.NET Core affecting .NET 11.0 preview releases and Microsoft Visual Studio 2026. The vulnerability stems from a discrepancy between how path prefix validation helpers (such as PathString.StartsWithSegments) and downstream routing mechanisms handle alternate path separators and percent-encoded characters. An unauthenticated remote attacker can exploit this mismatch over the network to bypass path-based authorization middleware and access restricted endpoints.

TL;DR

An improper path equivalence resolution flaw in ASP.NET Core (.NET 11.0 preview builds) allows unauthenticated remote attackers to bypass path-based security controls using alternate or encoded path delimiters. Updating to .NET 11.0.0 GA or Visual Studio 2026 version 18.12.0 resolves the issue.

Technical Details

Vulnerability ID: CVE-2026-114156
Weakness Class: CWE-41 (Improper Resolution of Path Equivalence)
CVSS v3.1 Score: 6.5 Medium (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N)
Attack Vector: Network (Unauthenticated HTTP Request)
Primary Impact: Security Feature Bypass (High Integrity, Low Confidentiality)
Affected Component: ASP.NET Core Path Processing (PathString.StartsWithSegments)
Exploit Status: Unproven (No Public PoCs)
CISA KEV Status: Not Listed

Affected Systems

Microsoft .NET 11.0 (Linux, macOS, Windows)
Microsoft ASP.NET Core 11.0
Microsoft Visual Studio 2026
.NET 11.0 (Linux, macOS, Windows): >= 11.0.0-preview.1, < 11.0.0 (Fixed in: 11.0.0)
Microsoft Visual Studio 2026: < 18.12.0 (Fixed in: 18.12.0)

Mitigation Strategies

Upgrade .NET 11.0 preview installations to the official .NET 11.0.0 GA release.
Migrate from custom path-prefix authorization middleware to ASP.NET Core Endpoint Routing authorization policies.
Configure reverse proxies and WAFs to block or normalize requests containing literal or percent-encoded backslashes (%5C) in the URI path.

Remediation Steps:

Identify all hosts and container images running .NET 11.0 preview builds (>= 11.0.0-preview.1, < 11.0.0) or Visual Studio 2026 (< 18.12.0).
Download and install the .NET 11.0.0 SDK and ASP.NET Core Runtime from official Microsoft package repositories.
Update Microsoft Visual Studio 2026 installations to version 18.12.0 or newer.
Audit application middleware pipelines for security checks relying on PathString.StartsWithSegments and refactor them to use endpoint-based RequireAuthorization().
Restart all affected Kestrel, IIS, and containerized ASP.NET Core worker processes to ensure the updated runtime assemblies are loaded.