CVE-2026-114146: Elevation of Privilege in ASP.NET Core SignalR Connection Dispatcher

ASP.NET Core includes Microsoft.AspNetCore.Http.Connections, the foundational library that manages persistent, real-time bidirectional communication for SignalR over HTTP-based transports. This subsystem exposes endpoints that handle connection negotiation, transport handshakes (WebSockets, Server-Sent Events, and Long Polling), and asynchronous message dispatching between connected clients and server-side SignalR Hubs. Because SignalR Hubs frequently expose privileged application logic and rely on connection-level authentication state, the integrity of the underlying HttpConnectionContext is critical to maintaining session isolation.

CVE-2026-114146 is an Incorrect Authorization vulnerability (CWE-863) located within the Microsoft.AspNetCore.Http.Connections.Internal namespace, specifically inside HttpConnectionDispatcher and HttpConnectionContext. During the multi-step lifecycle of a SignalR connection, the server allocates a state object upon receiving an initial negotiation request and assigns a unique connectionId and connectionToken. Prior to the security update, the dispatcher did not bind the authenticated user identity (HttpContext.User) from the negotiation request to the newly created connection context, nor did it verify that subsequent HTTP requests referencing that connection originated from the same principal.

Because the connection state remained decoupled from the negotiating caller's identity, an authenticated attacker who acquires a victim's connection identifier can interact with the connection endpoint directly. The attacker can bind their own transport channel to the victim's negotiated session or inject message payloads via the /send or /delete endpoints. When the application processes these injected requests, the SignalR hub executes the operations under the security context associated with the hijacked connection, resulting in a cross-session elevation of privilege.

To establish a SignalR connection, a client executes a multi-phase protocol managed by HttpConnectionDispatcher. First, the client sends an HTTP POST request to the /negotiate endpoint. The dispatcher invokes ProcessNegotiate, which calls HttpConnectionManager.CreateConnection to instantiate an HttpConnectionContext and returns the generated connectionId and connectionToken in the JSON response. Second, the client initiates the active transport (such as an HTTP GET request for Server-Sent Events or WebSockets, or repeated requests for Long Polling) by supplying the token in the query string. Third, when using HTTP-based transports like Long Polling or Server-Sent Events, client-to-server messages are transmitted via separate HTTP POST requests to the /send endpoint, while session termination uses HTTP DELETE requests.

The root cause of CVE-2026-114146 is the absence of identity binding during ProcessNegotiate and the lack of principal verification across subsequent state transitions in HttpConnectionDispatcher. When ProcessNegotiate created the connection via CreateConnection(options), the method signature and implementation ignored context.User. The resulting HttpConnectionContext existed in an unbound state until the first transport request called EnsureConnectionStateAsync, which blindly assigned connection.User = context.User without verifying whether that caller matched the user who negotiated the session.

Furthermore, even after connection.User was populated during transport initialization, subsequent out-of-band HTTP requests—specifically ProcessSend (handling POST payloads), ProcessDeleteAsync (handling DELETE termination requests), and subsequent Long Polling GET requests passing through EnsureConnectionStateAsync—did not compare the incoming request's HttpContext.User against the existing connection.User.In EnsureConnectionStateAsync, every new Long Polling request overwrote connection.User with the incoming context.User, whereas ProcessSend left connection.User untouched while processing the attacker's payload.

This design flaw breaks the state invariant between HTTP request authentication and persistent SignalR connection identity. In Hub method invocations where authorization logic or business operations inspect HubCallerContext.User, an attacker sending requests to /send executes commands under the victim's ClaimsPrincipal. Conversely, if an attacker intercepts a connection token immediately after /negotiate or between Long Polling cycles, the attacker can overwrite the principal or hijack the bidirectional stream.

The remediation, implemented across commits 514c86030195fd6b649bb26c48975a043d96b791, db8579880b30153dbd601fa079f49e7e3ce42e08, and e1ae50f427a49c76528376a5b3af8216bfda55bc, introduces a deterministic identity snapshot mechanism via the new UserIdentitySnapshot class and enforces verification across all dispatcher entry points.

In the vulnerable implementation of HttpConnectionDispatcher.cs, ProcessNegotiate allocated the connection without passing the caller's principal, and EnsureConnectionStateAsync unconditionally assigned connection.User:

// Vulnerable code in HttpConnectionDispatcher.cs
private async Task ProcessNegotiate(HttpContext context, HttpConnectionDispatcherOptions options)
{
    context.Response.ContentType = "application/json";
 
    // Establish the connection without recording context.User
    var connection = CreateConnection(options);
    await WriteNegotiatePayloadAsync(context.Response.BodyWriter, connection.ConnectionId, context, options, connection.ConnectionToken);
}
 
private async Task<bool> EnsureConnectionStateAsync(HttpConnectionContext connection, HttpContext context, HttpTransportType transportType, HttpConnectionDispatcherOptions options)
{
    // ... transport and state validation omitted ...
 
    // Overwrites or sets the user without checking against prior state
    connection.User = context.User;
    return true;
}

The patch modifies ProcessNegotiate to capture the negotiating ClaimsPrincipal and pass it to CreateConnection. It also injects a guard method, RejectIfConnectionUserChangedAsync, into ProcessSend, ProcessDeleteAsync, and EnsureConnectionStateAsync:

// Patched code in HttpConnectionDispatcher.cs
private async Task ProcessNegotiate(HttpContext context, HttpConnectionDispatcherOptions options)
{
    context.Response.ContentType = "application/json";
 
    // Bind the negotiating user's identity snapshot to the connection
    var connection = CreateConnection(options, context.User);
    await WriteNegotiatePayloadAsync(context.Response.BodyWriter, connection.ConnectionId, context, options, connection.ConnectionToken);
}
 
private async Task ProcessSend(HttpContext context)
{
    // ... connection lookup omitted ...
    if (await RejectIfConnectionUserChangedAsync(connection, context))
    {
        return;
    }
    // ... process payload ...
}
 
private async Task<bool> EnsureConnectionStateAsync(HttpConnectionContext connection, HttpContext context, HttpTransportType transportType, HttpConnectionDispatcherOptions options)
{
    // ... state validation omitted ...
    if (await RejectIfConnectionUserChangedAsync(connection, context))
    {
        return false;
    }
 
    // Seal the user principal and release the temporary negotiation snapshot
    connection.SetUserAndReleaseNegotiatedUser(context.User);
    return true;
}
 
private async Task<bool> RejectIfConnectionUserChangedAsync(HttpConnectionContext connection, HttpContext context)
{
    if (connection.IsUserAssociatedWithConnection(context.User))
    {
        return false;
    }
 
    Log.UserNameChanged(
        _logger,
        UserIdentitySnapshot.GetUserIdentityValue(connection.User),
        UserIdentitySnapshot.GetUserIdentityValue(context.User));
    context.Response.ContentType = "text/plain";
    context.Response.StatusCode = StatusCodes.Status403Forbidden;
    await context.Response.WriteAsync("The user associated with this connection changed.");
    return true;
}

To compare identities reliably across distinct HTTP requests (where object reference equality on ClaimsPrincipal fails because each request constructs a new principal instance), the patch introduces UserIdentitySnapshot. Rather than retaining the entire ClaimsPrincipal from the /negotiate request in memory, UserIdentitySnapshot.Capture extracts a minimal immutable representation:

// Key logic in UserIdentitySnapshot.cs
internal sealed class UserIdentitySnapshot
{
    private static readonly string[] _preferredClaimTypes =
        new[] { "sub", ClaimTypes.NameIdentifier, ClaimTypes.Upn };
 
    public static UserIdentitySnapshot Capture(ClaimsPrincipal? user)
    {
        if (!IsAuthenticated(user))
        {
            return Anonymous;
        }
 
        // 1. Check preferred unique identifiers in priority order: sub, NameIdentifier, Upn
        foreach (var preferredType in _preferredClaimTypes)
        {
            var claim = FindFirstClaim(user!, preferredType);
            if (claim is not null)
            {
                return new UserIdentitySnapshot(SnapshotKind.PreferredClaim,
                    new ClaimSnapshot(claim.Type, claim.Value, claim.Issuer), claims: null, name: null);
            }
        }
 
        // 2. Fallback: Capture and sort all claims by (Type, Value, Issuer)
        var claims = CaptureClaims(user!);
        if (claims.Length > 0)
        {
            return new UserIdentitySnapshot(SnapshotKind.Claims, preferredClaim: default, claims, name: null);
        }
 
        // 3. Fallback: Use Identity.Name if no claims exist
        // ...
    }
}

Fix Completeness Assessment

The patch addresses the vulnerability across all request entry points in HttpConnectionDispatcher (ProcessNegotiate, EnsureConnectionStateAsync, ProcessSend, and ProcessDeleteAsync). By comparing claim type, value, and issuer (via StringComparison.Ordinal), it prevents cross-issuer token substitution attacks. Furthermore, transitions between anonymous (IsAuthenticated == false) and authenticated states in either direction are explicitly rejected.

One edge case involves custom authentication handlers that construct an authenticated IIdentity where IsAuthenticated is true, but populate zero claims and leave Identity.Name null or empty (SnapshotKind.AuthenticatedWithoutClaimsOrName). In UserIdentitySnapshot.Matches, two distinct principals falling into this specific state will match each other because neither possesses distinguishing attributes. However, standard ASP.NET Core authentication schemes (JWT Bearer, Cookies, OpenID Connect, Windows Authentication) always populate NameIdentifier, sub, Upn, or Name, making the fix robust for standard deployments.

Exploiting CVE-2026-114146 requires the target application to expose an authenticated SignalR endpoint and requires the attacker to obtain a valid connectionToken (or connectionId in versions/configurations where they are equivalent) belonging to another session. Because PR:L (Privileges Required: Low) and UI:R (User Interaction: Required) apply, the attacker typically authenticates to the application using a low-privilege account and acquires the victim's connection token through shared network observation, browser history/referer leakage, diagnostic logs, or proxy access logs (since SignalR passes the token via the ?id= URL query parameter).

Scenario 1: Message Injection via /send (Long Polling / Server-Sent Events)

When a victim establishes a SignalR connection using Server-Sent Events or Long Polling, connection.User on the server is populated with the victim's ClaimsPrincipal. While this session is active, the attacker sends an HTTP POST request to the SignalR /send endpoint using the victim's id query parameter, authenticated with the attacker's own session cookie or bearer token:

POST /chatHub/send?id=VictimConnectionToken HTTP/1.1
Host: vulnerable-target.example.com
Authorization: Bearer <Attacker_Low_Priv_JWT>
Content-Type: text/plain;charset=UTF-8
Content-Length: 56
 
{"type":1,"target":"ExecuteAdminAction","arguments":["pwn"]}

In vulnerable versions, ProcessSend looks up the connection by id, skips identity verification, and writes the Hub invocation payload directly into the connection's application pipe. The SignalR HubDispatcher reads the message from the pipe and executes ExecuteAdminAction using connection.User (which remains set to the victim's principal), bypassing hub-level authorization checks.

Scenario 2: Pre-Transport Connection Hijacking

If an attacker intercepts or predicts the connectionToken returned by a victim's POST /negotiate request before the victim completes the transport handshake (GET /chatHub?id=...), or if a victim shares a pre-negotiated link, the attacker can issue the transport GET request first. Conversely, if the attacker negotiates a connection under their own account and tricks a privileged victim into connecting to that pre-negotiated URL, EnsureConnectionStateAsync overwrites connection.User with the victim's ClaimsPrincipal, allowing the attacker who knows the connectionId to interact with the session.

CVE-2026-114146 carries a CVSS v3.1 base score of 9.0 (Critical) with the vector CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H. The Scope metric is marked as Changed (S:C) because the vulnerability resides in the underlying ASP.NET Core HTTP connection dispatcher, while the impact crosses security boundaries into application-layer SignalR hubs and individual user security contexts.

• Confidentiality Impact (High): By hijacking a negotiated connection during transport initialization or polling intervals, an attacker can receive real-time messages, state updates, and sensitive data frames intended exclusively for the victim user.
• Integrity Impact (High): By injecting hub method invocations through /send, an attacker can execute arbitrary hub methods under the victim's identity (HubCallerContext.User). If the victim holds administrative privileges within the application, the attacker achieves full application-level privilege escalation.
• Availability Impact (High): An attacker possessing a valid connection identifier can send an authenticated HTTP DELETE request to the SignalR endpoint (ProcessDeleteAsync) or send malformed protocol frames to forcibly terminate the victim's active real-time connection.

At the time of publication, CVE-2026-114146 is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, and its Exploit Prediction Scoring System (EPSS) score shows no active automated exploitation telemetry. However, the commit history in the dotnet/aspnetcore repository contains comprehensive unit tests (HttpConnectionDispatcherTests.ConnectionBinding.cs) that clearly demonstrate the exact request sequences required to trigger the vulnerability.

To remediate CVE-2026-114146, organizations must update their .NET runtimes, SDKs, NuGet packages, and development environments to the patched servicing releases issued by Microsoft.

Patched Software Versions

• .NET 10.0: Upgrade to 10.0.15 or later.
• .NET 9.0: Upgrade to 9.0.23 or later.
• .NET 8.0: Upgrade to 8.0.34 or later.
• .NET 11.0: Upgrade from 11.0.0-preview.1 to 11.0.0 or later.
• Microsoft.AspNetCore.Http.Connections: For applications referencing the standalone package, update to version 1.2.14 or later.
• Microsoft Visual Studio: Update Visual Studio 2022 to 17.14.45 and Visual Studio 2026 to 18.11.4 (or apply the 18.12.0 servicing update).

> [!NOTE] > Self-contained .NET deployments bundle the vulnerable Microsoft.AspNetCore.Http.Connections.dll directly within the application artifact. These applications must be rebuilt and redeployed using the patched .NET SDK, whereas framework-dependent deployments can be remediated by updating the host server's shared ASP.NET Core runtime.

Workarounds and Compensating Controls

If immediate patching is not feasible, apply the following compensating controls to reduce the likelihood of exploitation:

1. Enforce WebSockets Only: Configure HttpConnectionDispatcherOptions.Transports on the server to allow only HttpTransportType.WebSockets. While this does not eliminate the pre-transport race window between /negotiate and the WebSocket upgrade request, it disables the /send endpoint and recurring Long Polling HTTP GET requests, eliminating post-connection message injection.
2. Enable SkipNegotiation for WebSockets: Where supported by the client architecture, configure clients to connect via WebSockets with SkipNegotiation = true. This bypasses the /negotiate HTTP round-trip entirely and establishes the connection in a single atomic WebSocket handshake.
3. Sanitize Connection Identifiers in Logs and Proxies: Because connectionToken values are passed in the ?id= query parameter, ensure that reverse proxies, Web Application Firewalls (WAFs), and application telemetry pipelines scrub query strings from shared logs to prevent low-privilege insiders from harvesting active tokens.