high · 8.8CVE-2026-47300Jul 21, 2026

CVE-2026-47300: Microsoft.AspNetCore.Authentication.Negotiate Elevation of Privilege via LDAP Role Retrieval

Shubham Kandhare
Security Engagement Manager, SecureLayer7

A logic flaw in ASP.NET Core's Negotiate authentication handler lets a low-privileged network attacker gain elevated roles when LDAP is used to look up group membership, because the handler does not…

PackageMicrosoft.AspNetCore.Authentication.Negotiate
Ecosystemnuget
Affected>= 10.0.0, <= 10.0.9
Fixed in10.0.10

The problem

The Negotiate authentication handler in Microsoft.AspNetCore.Authentication.Negotiate supports an optional LDAP role-retrieval path, used on Linux and macOS where Kerberos tickets carry no group information. The handler calls into an LDAP adapter to fetch group claims after a successful Kerberos handshake.

Due to an incorrect implementation of the authentication algorithm (CWE-303), the role-validation step in that LDAP path is flawed. An authenticated network attacker can exploit this to have the handler assign them role claims they are not entitled to, elevating their privileges within the application.

The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) confirms full confidentiality, integrity, and availability impact requiring only a low-privilege account.

The fix

Update Microsoft.AspNetCore.Authentication.Negotiate to 10.0.10 (for .NET 10), 9.0.18 (for .NET 9), or 8.0.29 (for .NET 8). If you deploy self-contained applications, recompile and redeploy against the patched runtime. Applications that do not use Negotiate authentication with LDAP role retrieval are not affected and require no change.

Reported by Artur Stetsko.

References: [1][2][3][4][5][6]

Related research