high · 8.8CVE-2026-47303Jul 21, 2026

CVE-2026-47303: Microsoft.AspNetCore.Authentication.Negotiate LDAP Injection Elevation of Privilege

Pranav Khune
Penetration Testing Team Lead, SecureLayer7

A flaw in ASP.NET Core's Negotiate authentication handler lets an attacker craft a malicious Kerberos or NTLM username that injects LDAP filter metacharacters, tricking the server into assigning…

PackageMicrosoft.AspNetCore.Authentication.Negotiate
Ecosystemnuget
Affected>= 10.0.0, <= 10.0.9
Fixed in10.0.10

The problem

When Negotiate authentication is configured with LDAP role retrieval on Linux, the handler takes the authenticated username straight from the Kerberos/NTLM token and embeds it into an LDAP search filter without sanitizing LDAP special characters.

Because Kerberos ticket content is treated as immutable and therefore trusted (CWE-302), a low-privileged user who controls their own principal name, or who can forge a token, can inject filter logic into the LDAP query (CWE-90). The manipulated query returns group memberships the user does not actually hold, causing the authorization layer to grant incorrect roles (CWE-863) up to and including SYSTEM privileges.

Proof of concept

A working proof-of-concept for CVE-2026-47303 in Microsoft.AspNetCore.Authentication.Negotiate, with the exact payload below.

text
# Attacker registers or controls a principal with a crafted username.
# The Negotiate handler builds an LDAP filter like:
#   (&(objectClass=user)(sAMAccountName=<USERNAME>))
# Injecting LDAP metacharacters via the username turns it into:
#   (&(objectClass=user)(sAMAccountName=*)(|(memberOf=cn=Domain Admins,dc=corp,dc=com)(x=x)))
#
# Crafted sAMAccountName value (injected as the Kerberos/NTLM username):
*)(|(memberOf=cn=Domain Admins,dc=corp,dc=com)(x=x

The Negotiate handler on Linux uses LdapAdapter to look up group memberships for the authenticated principal. Before the patch, the username extracted from the security token was concatenated directly into the LDAP filter string, with no escaping of characters like *, (, ), \, or NUL bytes defined in RFC 4515.

The injected payload closes the original filter clause and appends an OR branch that matches any user object whose memberOf attribute contains a privileged group DN. Because the LDAP server sees a valid (if unexpected) filter, it returns results indicating group membership that the real user does not hold, and the ASP.NET Core authorization middleware promotes them accordingly.

The fix adds RFC 4515-compliant escaping of the username before it is inserted into any LDAP filter, ensuring metacharacters are rendered as literal search values. Public PoC not yet available; payload derived from the CWE-90/CWE-302/CWE-863 triad and the known LdapAdapter filter-construction pattern in the aspnetcore source.

The fix

Update Microsoft.AspNetCore.Authentication.Negotiate to 10.0.10 (.NET 10), 9.0.18 (.NET 9), or 8.0.29 (.NET 8). Self-contained apps must be recompiled and redeployed against the patched SDK. Framework-dependent apps need the updated runtime installed and the application restarted.

Windows Update does not deliver this fix; apply the July 2026 .NET servicing release manually or via your package manager.

Reported by Pham Quang Minh.

References: [1][2][3][4][5][6]

Related research