CVE-2026-120792: Local Information Disclosure via Temporary File Logging in Microsoft .NET Aspire CLI

Microsoft .NET Aspire includes a command-line interface (Aspire.Cli) designed to manage cloud-native application orchestration, developer workflows, and AI agent integrations via the Model Context Protocol (MCP). A subcomponent of this tool, DeprecatedMcpCommandScanner, inspects local developer workspaces to identify legacy MCP startup commands (aspire mcp start) within agent configuration files and offers automated migration paths.

In .NET Aspire CLI versions 13.5.4 through < 13.6.5, the DeprecatedMcpCommandScanner component contains residual diagnostic logging code that operates automatically during agent initialization workflows (such as aspire agent init). This diagnostic logic writes operational telemetry directly to a hardcoded filename, aspire-deprecated-scan.log, located inside the operating system's default temporary directory (Path.GetTempPath()).

Tracked as CVE-2026-120792, this vulnerability represents a combination of CWE-532 (Insertion of Sensitive Information into Log File) and CWE-377 (Insecure Temporary File). Because the scanner logs up to the first 200 characters of every discovered MCP configuration file without redaction or access control restrictions, any sensitive secrets stored near the beginning of those JSON files are exposed to local users on the same machine.

The root cause of CVE-2026-120792 is the inclusion of non-production file-based debug logging inside the DeprecatedMcpCommandScanner.ScanAsync method in src/Aspire.Cli/Agents/DeprecatedMcpCommandScanner.cs. Rather than utilizing the application's configured ILogger pipeline, the method resolves a static file path by combining Path.GetTempPath() with the literal string "aspire-deprecated-scan.log".

When ScanAsync iterates over known agent configuration paths (s_configLocations, which includes configurations for Cursor, VS Code, Claude, and GitHub Copilot), it checks for the existence of each file on disk. Upon locating a valid configuration file, the method reads the entire file into memory using File.ReadAllText(configPath) and immediately writes a 200-character substring of the raw file content to the temporary log file via File.AppendAllText.

This implementation introduces two distinct security flaws at the operating system level:

1. World-Readable File Permissions in Shared Directories: On Unix-like systems (Linux and macOS), Path.GetTempPath() resolves to /tmp or /var/tmp. When .NET's File.AppendAllText creates a new file, it applies default permissions governed by the process umask (standardly 0022, resulting in 0644 or -rw-r--r-- permissions). Consequently, the log file is readable by any local user account on the host.
2. Predictable File Naming Without Exclusivity Checks: Because File.AppendAllText opens the target path without FileMode.CreateNew (O_CREAT | O_EXCL), the operation is vulnerable to pre-creation and symlink manipulation in shared temporary directories that lack fs.protected_symlinks kernel protections.

> [!NOTE] > Model Context Protocol (MCP) configuration files are compact JSON documents that define server execution parameters, headers, and environment blocks ("env": { "API_KEY": "..." }). The first 200 characters of these files routinely encapsulate primary authentication credentials and internal endpoint URIs.

The vulnerability resides in src/Aspire.Cli/Agents/DeprecatedMcpCommandScanner.cs. In vulnerable versions, the ScanAsync method interleaves standard _logger.LogDebug calls with nine separate calls to File.AppendAllText targeting debugPath.

Vulnerable Code Path

public Task ScanAsync(AgentEnvironmentScanContext context, CancellationToken cancellationToken)
{
    _logger.LogDebug("Scanning for deprecated MCP command usage in agent configurations");
 
    // VULNERABILITY: Hardcoded path in shared system temporary directory
    var debugPath = Path.Combine(Path.GetTempPath(), "aspire-deprecated-scan.log");
    File.AppendAllText(debugPath, $"[{DateTime.UtcNow:O}] Scanning context.RepositoryRoot: {context.RepositoryRoot.FullName}\n");
 
    foreach (var location in s_configLocations)
    {
        var configPath = Path.Combine(context.RepositoryRoot.FullName, location.RelativePath);
        File.AppendAllText(debugPath, $"[{DateTime.UtcNow:O}] Checking {location.AgentName}: {configPath}\n");
 
        if (!File.Exists(configPath))
        {
            File.AppendAllText(debugPath, $"[{DateTime.UtcNow:O}]   -> File does not exist\n");
            continue;
        }
 
        File.AppendAllText(debugPath, $"[{DateTime.UtcNow:O}]   -> File EXISTS!\n");
 
        try
        {
            var content = File.ReadAllText(configPath);
            // VULNERABILITY: Raw configuration content (up to 200 chars) written to shared log
            File.AppendAllText(debugPath, $"[{DateTime.UtcNow:O}]   -> Content: {content.Substring(0, Math.Min(200, content.Length))}\n");
            var config = JsonNode.Parse(content)?.AsObject();
            // ...

Patch Analysis

In commit c408ec5bf44e43203c278990a43aea93145248f3, Microsoft remediated the issue by removing all debugPath declarations and File.AppendAllText invocations from DeprecatedMcpCommandScanner.cs. Exception handling blocks were preserved and continue to use the structured _logger.LogDebug interface, which does not write to shared temporary files by default.

@@ -41,37 +41,26 @@ public Task ScanAsync(AgentEnvironmentScanContext context, CancellationToken can
     {
         _logger.LogDebug("Scanning for deprecated MCP command usage in agent configurations");
 
-        // Debug: Write scanning info to temp file for diagnostics
-        var debugPath = Path.Combine(Path.GetTempPath(), "aspire-deprecated-scan.log");
-        File.AppendAllText(debugPath, $"[{DateTime.UtcNow:O}] Scanning context.RepositoryRoot: {context.RepositoryRoot.FullName}\n");
-
         foreach (var location in s_configLocations)
         {
             var configPath = Path.Combine(context.RepositoryRoot.FullName, location.RelativePath);
-            File.AppendAllText(debugPath, $"[{DateTime.UtcNow:O}] Checking {location.AgentName}: {configPath}\n");
 
             if (!File.Exists(configPath))
             {
-                File.AppendAllText(debugPath, $"[{DateTime.UtcNow:O}]   -> File does not exist\n");
                 continue;
             }
 
-            File.AppendAllText(debugPath, $"[{DateTime.UtcNow:O}]   -> File EXISTS!\n");
-
             try
             {
                 var content = File.ReadAllText(configPath);
-                File.AppendAllText(debugPath, $"[{DateTime.UtcNow:O}]   -> Content: {content.Substring(0, Math.Min(200, content.Length))}\n");
                 var config = JsonNode.Parse(content)?.AsObject();
 
                 if (config is null)
                 {
-                    File.AppendAllText(debugPath, $"[{DateTime.UtcNow:O}]   -> JSON parse returned null\n");
                     continue;
                 }
 
                 var hasDeprecated = HasDeprecatedMcpCommand(config, location);
-                File.AppendAllText(debugPath, $"[{DateTime.UtcNow:O}]   -> HasDeprecatedMcpCommand: {hasDeprecated}\n");
 
                 if (hasDeprecated)
                 {
@@ -80,17 +69,14 @@ public Task ScanAsync(AgentEnvironmentScanContext context, CancellationToken can
                     // Create an applicator to update this config
                     var applicator = CreateUpdateApplicator(location, configPath, config);
                     context.AddApplicator(applicator);
-                    File.AppendAllText(debugPath, $"[{DateTime.UtcNow:O}]   -> Added applicator\n");
                 }
             }
             catch (JsonException ex)
             {
-                File.AppendAllText(debugPath, $"[{DateTime.UtcNow:O}]   -> JsonException: {ex.Message}\n");
                 _logger.LogDebug(ex, "Failed to parse {AgentName} config at {Path}", location.AgentName, configPath);
             }
             catch (IOException ex)
             {
-                File.AppendAllText(debugPath, $"[{DateTime.UtcNow:O}]   -> IOException: {ex.Message}\n");
                 _logger.LogDebug(ex, "Failed to read {AgentName} config at {Path}", location.AgentName, configPath);
             }
         }

Fix Completeness Assessment

The patch in commit c408ec5bf44e43203c278990a43aea93145248f3 completely eliminates the vulnerable code path in DeprecatedMcpCommandScanner. Furthermore, in companion commit 1ecd7cc70b5a5a5b8571fe3af69faa1646b8de47 (PR 67626), Microsoft relocated CLI SDK temporary working directories from the OS-shared /tmp directory to <ASPIRE_HOME>/tmp/sdk/<unique-id> with explicit 0700 owner-only permissions on Unix platforms. This systemic hardening prevents variant temporary file disclosure bugs across other CLI operations.

Exploiting CVE-2026-120792 requires local access to a multi-user host (such as a shared Linux development server, CI/CD build agent, or terminal server) where another user executes the .NET Aspire CLI.

Prerequisites

• Local Access (AV:L, PR:L): The attacker must possess a low-privileged local shell or execution context on the target machine.
• User Interaction (UI:R): A victim user on the same machine must run an Aspire CLI workflow that invokes DeprecatedMcpCommandScanner (such as aspire agent init) inside a repository containing MCP configuration files.

Attack Methodology

1. Passive Monitoring: The local attacker monitors the system temporary directory for the creation or modification of /tmp/aspire-deprecated-scan.log. Because the filename is static and predictable, no directory traversal or brute-forcing of random suffixes is necessary:

# Continuously watch or tail the predictable log file path
tail -F /tmp/aspire-deprecated-scan.log 2>/dev/null

2. Trigger Event: When the victim executes aspire agent init within their private home directory (e.g., /home/victim/project with 0700 permissions), the CLI scans .cursor/mcp.json or .vscode/mcp.json.

3. Data Exfiltration: The CLI writes the repository path and configuration header to /tmp/aspire-deprecated-scan.log with world-readable (0644) permissions. The attacker's tail process immediately captures output matching the following structure:

[2026-11-03T12:00:00.0000000Z] Scanning context.RepositoryRoot: /home/victim/confidential-project
[2026-11-03T12:00:00.0010000Z] Checking Cursor: /home/victim/confidential-project/.cursor/mcp.json
[2026-11-03T12:00:00.0020000Z]   -> File EXISTS!
[2026-11-03T12:00:00.0030000Z]   -> Content: {
  "mcpServers": {
    "production-db": {
      "command": "npx",
      "env": {
        "API_KEY": "sk-live-9876543210abcdef1234567890"
      }
    }
  }
}

4. Pre-Creation / Integrity Interference: Alternatively, if an attacker creates /tmp/aspire-deprecated-scan.log prior to the victim running the CLI and sets restrictive permissions (chmod 0000 /tmp/aspire-deprecated-scan.log), File.AppendAllText will throw an unhandled UnauthorizedAccessException (as the try/catch block in ScanAsync only catches JsonException and IOException, and File.AppendAllText outside the try block is completely unguarded), causing a denial of service in the victim's CLI session.

CVE-2026-120792 carries a CVSS v3.1 base score of 7.3 (High) with the vector CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:L.

Confidentiality Impact (C:H) & Scope Change (S:C)

The primary impact of this vulnerability is the unauthorized disclosure of high-value credentials stored inside MCP agent configurations. While the vulnerability is triggered locally within the context of the Aspire CLI process, the exposed credentials (such as cloud provider keys, LLM API tokens, internal database connection strings, and bearer tokens) authenticate against external infrastructure and remote services. Consequently, the CVSS Scope is Changed (S:C), as compromising the local log file grants the attacker access to external security domains beyond the local CLI environment.

Integrity (I:L) & Availability (A:L) Impact

Because the log file is opened outside of the try block at the start of ScanAsync without verifying file ownership or using exclusive creation flags:

var debugPath = Path.Combine(Path.GetTempPath(), "aspire-deprecated-scan.log");
File.AppendAllText(debugPath, $"[{DateTime.UtcNow:O}] Scanning context.RepositoryRoot: {context.RepositoryRoot.FullName}\n");

A local attacker can pre-create /tmp/aspire-deprecated-scan.log with read-only permissions to force File.AppendAllText to fail with an unhandled UnauthorizedAccessException, aborting the victim's aspire command execution (A:L). Furthermore, on operating systems or container environments where symlink protection (fs.protected_symlinks) is disabled, an attacker can symlink /tmp/aspire-deprecated-scan.log to a file owned by the victim, causing the victim's process to append log lines to an arbitrary target file (I:L).

Microsoft addressed CVE-2026-120792 in .NET Aspire version 13.6.5. Updating the CLI removes the temporary file logging functionality entirely, routing all diagnostic messages through the internal ILogger infrastructure.

Remediation Steps

1. Update .NET Aspire CLI: Upgrade all developer workstations, shared build servers, and CI/CD environments to .NET Aspire 13.6.5 or later:

dotnet workload update
# Or update the standalone Aspire.Cli package / binary to >= 13.6.5

2. Purge Residual Log Files: Updating the CLI does not automatically delete previously generated log files from the operating system's temporary directory. Administrators and developers must manually remove existing instances of aspire-deprecated-scan.log:

# Linux / macOS
rm -f /tmp/aspire-deprecated-scan.log /var/tmp/aspire-deprecated-scan.log
 
# Windows (PowerShell)
Remove-Item -Path "$env:TEMP\aspire-deprecated-scan.log" -Force -ErrorAction SilentlyContinue

3. Rotate Exposed Credentials: If aspire agent init or MCP scanning workflows were executed on shared or multi-user hosts using versions 13.5.4 through < 13.6.5, inspect any MCP configuration files (.cursor/mcp.json, .vscode/mcp.json, etc.) present in those workspaces and rotate all API keys, tokens, or secrets contained within them.

> [!NOTE] > Workaround for Unpatched Environments: If immediate upgrading is not feasible on a multi-user Unix system, users should configure a per-user isolated temporary directory (e.g., setting TMPDIR="$HOME/.tmp" with 0700 permissions) and set a restrictive umask 0077 prior to invoking aspire commands.