UBUNTU-CVE-2026-109481: High severity ubuntu/dotnet7 vulnerability
The Blazor/SignalR /blazor/refresh path can accept a cross-site request that binds a victim's authenticated principal to an attacker-owned circuit.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/dotnet11to a version that resolves this vulnerability.Fixed in 11.0.100-11.0.0-0ubuntu1~26.10.1
Event History
Frequently Asked Questions
What conditions are required for exploitation?
An attacker must cause a victim to make a cross-site request to the /_blazor/refresh path. The victim must have an authenticated principal that can be bound to an attacker-owned circuit, and user interaction is required.
Which Ubuntu software packages are identified as affected?
The affected software listed is ubuntu/dotnet7 and ubuntu/dotnet11.
What is the likely impact if exploitation succeeds?
Successful exploitation can bind the victim's authenticated principal to an attacker-controlled circuit. The listed impact includes high confidentiality, integrity, and availability effects.