CVE-2026-114156: Path Equivalence Security Feature Bypass in Microsoft ASP.NET Core

Microsoft ASP.NET Core provides a modular HTTP request pipeline where middleware components inspect, modify, or short-circuit incoming requests before they reach terminal routing endpoints. A common architectural pattern involves inspecting the request URI path within custom middleware to enforce authentication, authorization, or rate-limiting policies on specific route prefixes, such as /admin or /internal. To facilitate this, the framework exposes the Microsoft.AspNetCore.Http.PathString struct and its associated segment-matching methods.

CVE-2026-114156 is a security feature bypass vulnerability classified under CWE-41 (Improper Resolution of Path Equivalence). The defect resides in how ASP.NET Core HTTP path evaluation helpers validate segment boundaries when requests contain non-standard path delimiters or percent-encoded characters, specifically within .NET 11.0 preview builds (>= 11.0.0-preview.1, < 11.0.0) and associated Microsoft Visual Studio 2026 releases.

When an application relies on prefix-matching methods like PathString.StartsWithSegments to gate access to restricted areas, an attacker can supply an equivalent path representation using encoded backslashes (%5C) or mixed directory separators. The prefix validation check evaluates to false, allowing the request to bypass the security middleware. Downstream routing or reverse proxy components subsequently normalize the path, resolving it to the protected target endpoint.

The root cause of CVE-2026-114156 is a canonicalization discrepancy—often referred to as an impedance mismatch—between early-stage path evaluation methods and late-stage route dispatching within the ASP.NET Core request processing pipeline. In the HTTP specification (RFC 3986), the forward slash (/) is the standard path segment delimiter. However, Windows-based file systems, legacy web servers (such as IIS), and certain reverse proxies treat the backslash (\) or its percent-encoded equivalent (%5C / %5c) as interchangeable with the forward slash.

Within the ASP.NET Core HTTP abstractions layer, PathString.StartsWithSegments is designed to verify whether a request path begins with a given prefix on a strict segment boundary. For example, checking if a path starts with /admin must match /admin and /admin/users, but must not match /administrator. To enforce this, the method verifies that the character immediately following the matched prefix is either the end of the string or a forward slash delimiter (/).

When an incoming request contains a percent-encoded backslash (e.g., /admin%5Cusers) or an unnormalized literal backslash, PathString.StartsWithSegments inspects the character following /admin. If the method evaluates the raw or partially decoded string where \ is not recognized as a valid segment boundary, it treats admin\users as a single contiguous segment (similar to administrator). Consequently, StartsWithSegments("/admin") returns false.

Once the request passes the middleware guard without triggering the authorization requirement, it reaches the endpoint routing middleware, static file provider, or an upstream/downstream proxy layer that performs full path normalization. This downstream component converts \ or %5C into a standard / delimiter and dispatches the request directly to the /admin/users handler.

In ASP.NET Core applications, developers frequently write custom middleware to apply security policies across groups of endpoints before the routing table is evaluated. The vulnerable pattern involves branching security logic based on the boolean return value of PathString.StartsWithSegments.

// Vulnerable Middleware Pattern in ASP.NET Core
app.Use(async (context, next) =>
{
    // Developer attempts to restrict access to all routes under /admin
    if (context.Request.Path.StartsWithSegments("/admin", out var remainingPath))
    {
        if (!context.User.Identity?.IsAuthenticated ?? true)
        {
            context.Response.StatusCode = StatusCodes.Status401Unauthorized;
            return;
        }
        
        if (!context.User.IsInRole("Administrator"))
        {
            context.Response.StatusCode = StatusCodes.Status403Forbidden;
            return;
        }
    }
 
    // If StartsWithSegments returns false, execution continues unchallenged
    await next(context);
});

Inside the PathString implementation, segment boundary validation historically checked only for the standard forward slash / character after confirming the prefix characters matched:

// Conceptual representation of the vulnerable boundary check
public bool StartsWithSegments(PathString other, StringComparison comparisonType, out PathString remaining)
{
    var value1 = Value ?? string.Empty;
    var value2 = other.Value ?? string.Empty;
 
    if (value1.StartsWith(value2, comparisonType))
    {
        // Vulnerable assumption: only '/' is checked as a valid segment delimiter.
        // If value1[value2.Length] is '\' (decoded from %5C), this check fails.
        if (value1.Length == value2.Length || value1[value2.Length] == '/')
        {
            remaining = new PathString(value1.Substring(value2.Length));
            return true;
        }
    }
    remaining = PathString.Empty;
    return false;
}

To remediate this class of vulnerability, the HTTP request pipeline and path manipulation primitives in .NET 11.0.0 GA were updated to enforce consistent path canonicalization and delimiter handling across Kestrel, HTTP.sys, IIS integration, and PathString evaluation. Additionally, architectural guidance requires binding authorization directly to resolved endpoints rather than inspecting uncanonicalized path prefixes:

// Secure Pattern: Endpoint-bound authorization policy
app.MapGroup("/admin")
   .RequireAuthorization("AdminPolicy")
   .MapGet("/users", () => Results.Ok(GetUsers()));

By attaching .RequireAuthorization() to the route group or endpoint definition, the authorization check executes only after the routing engine has normalized the path and matched the exact terminal handler, eliminating the possibility of a desynchronization bypass.

Exploiting CVE-2026-114156 requires no authentication (PR:N) and no user interaction (UI:N), though it is rated as having High Attack Complexity (AC:H). The complexity rating reflects that the target application must be configured in a specific manner: it must rely on path-prefix checks (such as custom middleware using PathString.StartsWithSegments) rather than endpoint routing authorization, and it must operate behind a web server or pipeline configuration that normalizes alternate path separators downstream.

An attacker initiates exploitation by identifying a protected route prefix (e.g., /admin/config or /api/internal/export) that returns 401 Unauthorized or 403 Forbidden when accessed directly via standard HTTP requests.

GET /admin/config HTTP/1.1
Host: vulnerable-target.example.com
 
HTTP/1.1 403 Forbidden

The attacker then crafts an HTTP request replacing the segment delimiter immediately following the protected prefix with a percent-encoded backslash (%5C or %5c), or mixes path traversal sequences that resolve equivalently in the backend dispatcher:

GET /admin%5Cconfig HTTP/1.1
Host: vulnerable-target.example.com
 
HTTP/1.1 200 OK
Content-Type: application/json

When the server receives GET /admin%5Cconfig, the request parsing layer decodes %5C into \ (or leaves it unnormalized depending on the hosting model). The custom authorization middleware executes Request.Path.StartsWithSegments("/admin"). Because the character at index 6 is \ rather than /, the method returns false. The middleware assumes the request targets an unrelated public route and invokes await next(context). The downstream router then normalizes \ to / and executes the /admin/config controller action.

> [!NOTE] > As of the vulnerability publication date, Microsoft classifies exploit code maturity as Unproven (E:U), and no standalone weaponized PoCs have been published in public exploit databases.

The primary impact of CVE-2026-114156 is a high loss of integrity (I:H) and a low loss of confidentiality (C:L), resulting in a CVSS v3.1 base score of 6.5 (Medium). Because the vulnerability is a security feature bypass rather than a direct memory corruption or code execution flaw, the exact operational impact is governed by the functionality exposed by the unprotected downstream endpoints.

In scenarios where applications use middleware prefix checks to protect state-changing administrative operations—such as user management, configuration updates, or data deletion—an unauthenticated attacker can invoke these endpoints directly, leading to a high integrity impact. Similarly, attackers can read restricted application data exposed by bypassed endpoints, accounting for the confidentiality impact.

Availability is not directly impacted (A:N) by the path resolution mechanism itself, unless an exposed administrative endpoint explicitly provides system shutdown or resource-exhaustion functionality.

From a threat intelligence perspective, CVE-2026-114156 affects preview builds of .NET 11.0 (>= 11.0.0-preview.1, < 11.0.0) across Linux, macOS, and Windows platforms, as well as early builds of Visual Studio 2026 prior to 18.12.0. Because affected versions are limited to pre-release SDK and runtime distributions prior to the .NET 11.0.0 General Availability (GA) release, production exposure is confined to organizations deploying preview frameworks in internet-facing environments.

Microsoft addressed CVE-2026-114156 in the official General Availability release of .NET 11.0 (11.0.0) and Microsoft Visual Studio 2026 version 18.12.0. Organizations running any .NET 11.0.0-preview.* or .NET 11.0.0-rc.* builds on Linux, macOS, or Windows must upgrade their SDKs, ASP.NET Core runtimes, and hosting bundles to version 11.0.0 or later.

For environments where immediate runtime patching is delayed, security teams can mitigate the vulnerability through architectural and infrastructure changes. First, developers should audit application source code for custom middleware utilizing Request.Path.StartsWithSegments, Request.Path.Value.StartsWith, or regular expressions for security enforcement. These checks should be replaced with ASP.NET Core's built-in Endpoint Routing authorization (RequireAuthorization() or [Authorize] attributes), which binds access control directly to the resolved endpoint metadata.

Second, edge reverse proxies (such as Nginx, Envoy, YARP, or IIS) and Web Application Firewalls (WAFs) should be configured to strictly canonicalize incoming request URIs before forwarding traffic to Kestrel backends. Specifically, edge proxies should reject or normalize requests containing literal backslashes (\) or percent-encoded backslashes (%5C, %5c) within the URI path component.

# Example Nginx configuration block to reject encoded backslashes in URI paths
if ($request_uri ~* "%5c") {
    return 400;
}

Implementing strict URI validation at the network perimeter prevents path equivalence payloads from reaching the ASP.NET Core middleware pipeline.