CVE-2026-58649

Origin validation error in .NET allows an unauthorized attacker to disclose information over a network.

A moderate information disclosure vulnerability was found in the .NET SDK, where the dotnet watch BrowserRefreshServer does not adequately validate the origin of cross-origin WebSocket connections. A remote, unauthenticated attacker who tricks a user into interacting with attacker-controlled web content can connect to the browser-refresh WebSocket used during development and retrieve compiled intermediate language (IL) assemblies and program database (PDB) debug files from the development environment, exposing information that should remain confidential. Red Hat rates this issue as moderate severity (CVSS 3.1 score 6.5, AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N), matching the upstream severity. Red Hat Enterprise Linux 8, 9, and 10, Red Hat In-Vehicle OS 2, and Red Hat hardened images that ship the affected .NET SDK (dotnet8.0, dotnet9.0, dotnet10.0) are affected, and fixes are being pursued for these components.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.