ALPINE-CVE-2026-114148: High severity alpine/dotnet10-runtime vulnerability

Q: Who is exposed to this issue?

Systems using the affected Alpine .NET runtime packages are exposed: alpine/dotnet8-runtime, alpine/dotnet9-runtime, and alpine/dotnet10-runtime. Exploitation requires local access by an authorized attacker.

Q: What level of access does an attacker need?

An attacker must already be authorized with local access and have low privileges. No user interaction is required for exploitation.

Q: What is the potential impact of successful exploitation?

A successful attacker can elevate privileges locally. The listed impact includes high confidentiality, integrity, and availability effects.

Q: Is this a remotely exploitable issue?

The provided attack vector is local, so the issue is not described as remotely exploitable. The attacker must be able to execute or act on the affected system locally.

Published Oct 29, 2026

Updated

Incorrect default permissions in ASP.NET Core allows an authorized attacker to elevate privileges locally.

Affected Software

7 affected componentsFixes available

alpine/dotnet10-runtime<10.0.14-r0

10.0.14-r0

alpine/dotnet8-runtime<8.0.33-r0

8.0.33-r0

alpine/dotnet8-runtime<8.0.33-r0

8.0.33-r0

alpine/dotnet8-runtime<8.0.33-r0

8.0.33-r0

alpine/dotnet9-runtime<9.0.22-r0

9.0.22-r0

alpine/dotnet9-runtime<9.0.22-r0

9.0.22-r0

alpine/dotnet9-runtime<9.0.22-r0

9.0.22-r0

Event History

Oct 29, 2026

CVE Published

via OSV·04:17 PM

Data Sourced

via OSV·04:17 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

Who is exposed to this issue?

Systems using the affected Alpine .NET runtime packages are exposed: alpine/dotnet8-runtime, alpine/dotnet9-runtime, and alpine/dotnet10-runtime. Exploitation requires local access by an authorized attacker.

What level of access does an attacker need?

An attacker must already be authorized with local access and have low privileges. No user interaction is required for exploitation.

What is the potential impact of successful exploitation?

A successful attacker can elevate privileges locally. The listed impact includes high confidentiality, integrity, and availability effects.

Is this a remotely exploitable issue?

The provided attack vector is local, so the issue is not described as remotely exploitable. The attacker must be able to execute or act on the affected system locally.

ALPINE-CVE-2026-114148: High severity alpine/dotnet10-runtime vulnerability

Affected Software

Event History

Frequently Asked Questions

Who is exposed to this issue?

What level of access does an attacker need?

What is the potential impact of successful exploitation?

Is this a remotely exploitable issue?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

What level of access does an attacker need?

What is the potential impact of successful exploitation?

Is this a remotely exploitable issue?