UBUNTU-CVE-2026-114146: Medium severity ubuntu/dotnet6 vulnerability

Q: What must an attacker be able to do to exploit this issue?

The attacker must be able to inject messages into a SignalR connection. Those injected messages can cause Hub invocations to run as the identity negotiated when the victim connection was established.

Q: Which Ubuntu .NET packages are listed as affected?

The affected software listed is ubuntu/dotnet6, ubuntu/dotnet8, ubuntu/dotnet10, and ubuntu/dotnet11.

Published Nov 10, 2026

Updated

SignalR connections are not consistently bound to the identity negotiated at connection establishment, allowing injected messages to execute Hub invocations as the victim.

Affected Software

7 affected componentsFixes available

ubuntu/dotnet6*

ubuntu/dotnet8<8.0.134-8.0.34-0ubuntu1~22.04.1

8.0.134-8.0.34-0ubuntu1~22.04.1

ubuntu/dotnet10<10.0.115-10.0.15-0ubuntu1~24.04.1

10.0.115-10.0.15-0ubuntu1~24.04.1

ubuntu/dotnet8<8.0.134-8.0.34-0ubuntu1~24.04.1

8.0.134-8.0.34-0ubuntu1~24.04.1

ubuntu/dotnet10<10.0.115-10.0.15-0ubuntu1~26.10.1

10.0.115-10.0.15-0ubuntu1~26.10.1

ubuntu/dotnet11<11.0.100-11.0.0-0ubuntu1~26.10.1

11.0.100-11.0.0-0ubuntu1~26.10.1

ubuntu/dotnet10<10.0.115-10.0.15-0ubuntu1~26.04.1

10.0.115-10.0.15-0ubuntu1~26.04.1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade ubuntu/dotnet8 to a version that resolves this vulnerability.
Fixed in 8.0.134-8.0.34-0ubuntu1~22.04.1
Upgrade
Upgrade ubuntu/dotnet10 to a version that resolves this vulnerability.
Fixed in 10.0.115-10.0.15-0ubuntu1~24.04.1
Upgrade
Upgrade ubuntu/dotnet8 to a version that resolves this vulnerability.
Fixed in 8.0.134-8.0.34-0ubuntu1~24.04.1
Upgrade
Upgrade ubuntu/dotnet10 to a version that resolves this vulnerability.
Fixed in 10.0.115-10.0.15-0ubuntu1~26.10.1
Upgrade
Upgrade ubuntu/dotnet11 to a version that resolves this vulnerability.
Fixed in 11.0.100-11.0.0-0ubuntu1~26.10.1
Upgrade
Upgrade ubuntu/dotnet10 to a version that resolves this vulnerability.
Fixed in 10.0.115-10.0.15-0ubuntu1~26.04.1

Event History

Nov 10, 2026

CVE Published

via OSV·12:00 AM

Data Sourced

via OSV·12:00 AM

DescriptionSeverityAffected Software

Frequently Asked Questions

What must an attacker be able to do to exploit this issue?

The attacker must be able to inject messages into a SignalR connection. Those injected messages can cause Hub invocations to run as the identity negotiated when the victim connection was established.

Which Ubuntu .NET packages are listed as affected?