CVE-2026-70188
CriticalAdvisory
Published 13 Oct 2026In the index since 14 Oct 2026
- Severity
- Critical
- worst across findings
- CVSS
- 9.1
- base score, highest
- EPSS
- —
- probability of exploitation
- CISA KEV
- Not listed
- no confirmed exploitation
- Charts affected
- 81
- of 18,117 indexed, latest versions
- Container images
- 101
- deployed by those charts
- Fix available
- 2 of 2
- affected packages
Microsoft Security Advisory CVE-2026-70188 - ASP.NET Core Security Feature Bypass Vulnerability
Carried by container images the latest versions of 81 of 18,117 indexed charts deploy, on 101 images.
| Affected package | Affected versions | Fixed in | Images |
|---|---|---|---|
| Microsoft.AspNetCore.App.Runtime.linux-x64nuget | 8.0.3, 8.0.4, 8.0.8, 8.0.10+12 more | 8.0.32, 9.0.21, 10.0.13 | 58 |
| Microsoft.AspNetCore.App.Runtime.linux-musl-x64nuget | 8.0.30, 9.0.11, 9.0.15, 9.0.20+2 more | 8.0.32, 9.0.21, 10.0.13 | 43 |
- OSV records
- GHSA-fpq8-4vhr-rcxx
Charts affected
81 by stars
| Chart | Latest | Affected images | Radar Score |
|---|---|---|---|
| reflectoremberstackVerified publisher | 10.0.65 | 1 of 1See more | 1,009 |
| aspnet-corebitnamiVerified publisher | 9.5.1 | 2 of 3See more | 499 |
| technitium-dnsserverobeoneVerified publisher | 1.13.4 | 1 of 1See more | 841 |
| oidc-guardoidc-guardVerified publisher | 3.8.50 | 1 of 1See more | 119 |
| alerthawkalerthawkOfficialVerified publisher | 3.3.32 | 5 of 6See more | 2,788 |
| aramid-participationbiatec-repoVerified publisher | 4.4.1 | 1 of 1See more | 8,545 |
| voimain-participationbiatec-repoVerified publisher | 4.4.1 | 1 of 1See more | 8,545 |
| self-hostbitwarden | 2.5.2 | 10 of 11See more | 7,320 |
| nethermindchronicleVerified publisher | 0.0.15 | 1 of 1See more | 2,478 |
| opentelemetry-demoopentelemetry-helmOfficialVerified publisher | 0.42.4 | 1 of 34See more | 27,137 |
| kyoorubxkubeVerified publisher | 0.1.10 | 1 of 9See more | 34,600 |
| vaultwarden-kubernetes-secretsvaultwarden-kubernetes-secrets | 0.0.0-main | 1 of 2See more | 4,668 |
| reflectorwener | 10.0.65 | 1 of 1See more | 1,009 |
| aks-kargo-analysisrun-logsaks-kargo-analysisrun-logsVerified publisher | 1.1.53 | 1 of 1See more | 107 |
| alerthawk.agentalerthawkVerified publisher | 3.3.10 | 1 of 1See more | 478 |
| alerthawk-metrics-agentalerthawkVerified publisher | 3.3.15 | 1 of 1See more | 478 |
| aspire-dashboardaspire-dashboard | 1.31.0 | 1 of 1See more | 124 |
| auth0-operatorauth0-operator | 1.4.12 | 1 of 1See more | 1,047 |
| batch-job-helmbatch-job | 0.1.1 | 1 of 2See more | 3,170 |
| algorand-participationbiatec-repoVerified publisher | 4.4.1 | 1 of 1See more | 8,545 |
| fhir-server-exporterchglVerified publisher | 1.2.41 | 1 of 1See more | 311 |
| ms-catalogs-restcodedesignplus-chartsVerified publisher | 0.0.24 | 1 of 1See more | 210 |
| ms-emails-grpccodedesignplus-chartsVerified publisher | 0.0.24 | 1 of 1See more | 6,450 |
| ms-emails-restcodedesignplus-chartsVerified publisher | 0.0.24 | 1 of 1See more | 6,450 |
| ms-emails-workercodedesignplus-chartsVerified publisher | 0.0.24 | 1 of 1See more | 225 |
| ms-filestorage-grpccodedesignplus-chartsVerified publisher | 0.0.24 | 1 of 1See more | 210 |
| ms-filestorage-restcodedesignplus-chartsVerified publisher | 0.0.24 | 1 of 1See more | 210 |
| ms-licenses-grpccodedesignplus-chartsVerified publisher | 0.0.24 | 1 of 1See more | 1,440 |
| ms-licenses-restcodedesignplus-chartsVerified publisher | 0.0.24 | 1 of 1See more | 210 |
| ms-licenses-workercodedesignplus-chartsVerified publisher | 0.0.24 | 1 of 1See more | 210 |
| ms-locations-grpccodedesignplus-chartsVerified publisher | 0.0.24 | 1 of 1See more | 210 |
| ms-locations-restcodedesignplus-chartsVerified publisher | 0.0.24 | 1 of 1See more | 210 |
| ms-microsoftgraph-restcodedesignplus-chartsVerified publisher | 0.0.24 | 1 of 1See more | 225 |
| ms-microsoftgraph-workercodedesignplus-chartsVerified publisher | 0.0.24 | 1 of 1See more | 225 |
| ms-modules-grpccodedesignplus-chartsVerified publisher | 0.0.24 | 1 of 1See more | 1,440 |
| ms-modules-restcodedesignplus-chartsVerified publisher | 0.0.24 | 1 of 1See more | 210 |
| ms-notification-grpccodedesignplus-chartsVerified publisher | 0.0.24 | 1 of 1See more | 330 |
| ms-notification-restcodedesignplus-chartsVerified publisher | 0.0.24 | 1 of 1See more | 210 |
| ms-payments-grpccodedesignplus-chartsVerified publisher | 0.0.24 | 1 of 1See more | 210 |
| ms-payments-restcodedesignplus-chartsVerified publisher | 0.0.24 | 1 of 1See more | 210 |
| ms-payments-workercodedesignplus-chartsVerified publisher | 0.0.24 | 1 of 1See more | 210 |
| ms-rbac-grpccodedesignplus-chartsVerified publisher | 0.0.24 | 1 of 1See more | 210 |
| ms-rbac-restcodedesignplus-chartsVerified publisher | 0.0.24 | 1 of 1See more | 210 |
| ms-roles-restcodedesignplus-chartsVerified publisher | 0.0.24 | 1 of 1See more | 210 |
| ms-services-grpccodedesignplus-chartsVerified publisher | 0.0.24 | 1 of 1See more | 210 |
| ms-services-restcodedesignplus-chartsVerified publisher | 0.0.24 | 1 of 1See more | 210 |
| ms-tenants-grpccodedesignplus-chartsVerified publisher | 0.0.24 | 1 of 1See more | 210 |
| ms-tenants-restcodedesignplus-chartsVerified publisher | 0.0.24 | 1 of 1See more | 210 |
| ms-tenants-workercodedesignplus-chartsVerified publisher | 0.0.24 | 1 of 1See more | 210 |
| ms-users-grpccodedesignplus-chartsVerified publisher | 0.0.24 | 1 of 1See more | 210 |
Container images carrying it
101 by charts deploying them
A fixed version is listed for 2 of the 2 affected packages.
| Container image | Digest | Package | Fixed in | Used by |
|---|---|---|---|---|
| scholtz2/ | 64966de56d9f | Microsoft.AspNetCore.App.Runtime.linux-x64 | 8.0.32 | 1 |
| sepehrmdn/ | 2567228e33c8 | Microsoft.AspNetCore.App.Runtime.linux-x64 | 9.0.21 | 1 |
| siscc/ | 9c334b91d745 | Microsoft.AspNetCore.App.Runtime.linux-x64 | 10.0.13 | 1 |
| siscc/ | 6cf1145566f0 | Microsoft.AspNetCore.App.Runtime.linux-musl-x64 | 8.0.32 | 1 |
| sondresjo/ | 401fabc6aa5e | Microsoft.AspNetCore.App.Runtime.linux-x64 | 10.0.13 | 1 |
| sondresjo/ | fe534731909a | Microsoft.AspNetCore.App.Runtime.linux-x64 | 8.0.32 | 1 |
| sondresjo/ | 4299b540971b | Microsoft.AspNetCore.App.Runtime.linux-x64 | 10.0.13 | 1 |
| sondresjo/ | a414ee2a3d5e | Microsoft.AspNetCore.App.Runtime.linux-x64 | 10.0.13 | 1 |
| sondresjo/ | ce827dcb8284 | Microsoft.AspNetCore.App.Runtime.linux-x64 | 10.0.13 | 1 |
| sondresjo/ | 4789c6031d93 | Microsoft.AspNetCore.App.Runtime.linux-x64 | 10.0.13 | 1 |
| technitium/ | b8efe03a5e3b | Microsoft.AspNetCore.App.Runtime.linux-x64 | 10.0.13 | 1 |
| technitium/ | e5474007d142 | Microsoft.AspNetCore.App.Runtime.linux-x64 | 10.0.13 | 1 |
| thiagoguaru/ | a769f8094271 | Microsoft.AspNetCore.App.Runtime.linux-x64 | 10.0.13 | 1 |
| thiagoguaru/ | 5b7d7fb62dc6 | Microsoft.AspNetCore.App.Runtime.linux-x64 | 10.0.13 | 1 |
| thiagoguaru/ | 9c88dbaef8df | Microsoft.AspNetCore.App.Runtime.linux-x64 | 10.0.13 | 1 |
| thiagoguaru/ | 4d5905ceaaf6 | Microsoft.AspNetCore.App.Runtime.linux-x64 | 10.0.13 | 1 |
| thiagoguaru/ | 265884082396 | Microsoft.AspNetCore.App.Runtime.linux-x64 | 10.0.13 | 1 |
| thomaszy2077/ | a271ab8a80bd | Microsoft.AspNetCore.App.Runtime.linux-x64 | 8.0.32 | 1 |
| tibyandocker/ | a4ad592cea84 | Microsoft.AspNetCore.App.Runtime.linux-x64 | 9.0.21 | 1 |
| worthnl/ | e4e232b4aab9 | Microsoft.AspNetCore.App.Runtime.linux-x64 | 10.0.13 | 1 |
| ghcr.io/ | 2468990a8521 | Microsoft.AspNetCore.App.Runtime.linux-x64 | 10.0.13 | 1 |
| ghcr.io/ | 13e267ad7d94 | Microsoft.AspNetCore.App.Runtime.linux-x64 | 10.0.13 | 1 |
| ghcr.io/ | e82f37409cce | Microsoft.AspNetCore.App.Runtime.linux-musl-x64 | 10.0.13 | 1 |
| ghcr.io/ | 72abdfb33c83 | Microsoft.AspNetCore.App.Runtime.linux-musl-x64 | 10.0.13 | 1 |
| ghcr.io/ | a3e09f120b64 | Microsoft.AspNetCore.App.Runtime.linux-musl-x64 | 10.0.13 | 1 |
| ghcr.io/ | 818a1d907fc4 | Microsoft.AspNetCore.App.Runtime.linux-musl-x64 | 10.0.13 | 1 |
| ghcr.io/ | 5e23eaab3976 | Microsoft.AspNetCore.App.Runtime.linux-musl-x64 | 10.0.13 | 1 |
| ghcr.io/ | 63037d60f7d8 | Microsoft.AspNetCore.App.Runtime.linux-musl-x64 | 10.0.13 | 1 |
| ghcr.io/ | 63a75561b94c | Microsoft.AspNetCore.App.Runtime.linux-musl-x64 | 10.0.13 | 1 |
| ghcr.io/ | 029f0d8a576f | Microsoft.AspNetCore.App.Runtime.linux-musl-x64 | 10.0.13 | 1 |
| ghcr.io/ | 3ef058df2039 | Microsoft.AspNetCore.App.Runtime.linux-musl-x64 | 10.0.13 | 1 |
| ghcr.io/ | 0d9b5f239cb8 | Microsoft.AspNetCore.App.Runtime.linux-musl-x64 | 10.0.13 | 1 |
| ghcr.io/ | 26f8963a44d4 | Microsoft.AspNetCore.App.Runtime.linux-x64 | 10.0.13 | 1 |
| ghcr.io/ | cfada3e57214 | Microsoft.AspNetCore.App.Runtime.linux-x64 | 10.0.13 | 1 |
| ghcr.io/ | ed1c3fd04057 | Microsoft.AspNetCore.App.Runtime.linux-musl-x64 | 9.0.21 | 1 |
| ghcr.io/ | c9e63bffb931 | Microsoft.AspNetCore.App.Runtime.linux-musl-x64 | 10.0.13 | 1 |
| ghcr.io/ | 80c5777a293e | Microsoft.AspNetCore.App.Runtime.linux-musl-x64 | 10.0.13 | 1 |
| ghcr.io/ | af5d4b28ef3a | Microsoft.AspNetCore.App.Runtime.linux-x64 | 10.0.13 | 1 |
| ghcr.io/ | eb959d566216 | Microsoft.AspNetCore.App.Runtime.linux-x64 | 10.0.13 | 1 |
| ghcr.io/ | 462b7b384ee6 | Microsoft.AspNetCore.App.Runtime.linux-x64 | 10.0.13 | 1 |
| ghcr.io/ | c3af06abdae7 | Microsoft.AspNetCore.App.Runtime.linux-x64 | 10.0.13 | 1 |
| ghcr.io/ | 9584941d1977 | Microsoft.AspNetCore.App.Runtime.linux-x64 | 10.0.13 | 1 |
| ghcr.io/ | 763550d9b404 | Microsoft.AspNetCore.App.Runtime.linux-x64 | 10.0.13 | 1 |
| ghcr.io/ | 8a5e3258fc66 | Microsoft.AspNetCore.App.Runtime.linux-x64 | 10.0.13 | 1 |
| ghcr.io/ | 734d28a296d9 | Microsoft.AspNetCore.App.Runtime.linux-x64 | 10.0.13 | 1 |
| ghcr.io/ | 6d051840bb29 | Microsoft.AspNetCore.App.Runtime.linux-x64 | 8.0.32 | 1 |
| ghcr.io/ | bfd9d13ac58a | Microsoft.AspNetCore.App.Runtime.linux-x64 | 10.0.13 | 1 |
| ghcr.io/ | 8232cb0ddcf5 | Microsoft.AspNetCore.App.Runtime.linux-musl-x64 | 10.0.13 | 1 |
| ghcr.io/ | bce6aca0f6ca | Microsoft.AspNetCore.App.Runtime.linux-musl-x64 | 9.0.21 | 1 |
| ghcr.io/ | 416e980f76a6 | Microsoft.AspNetCore.App.Runtime.linux-x64 | 8.0.32 | 1 |