.NET 10.0.12 runtime findings in the 1.0.0–1.2.1 Orchestrator images

What was found

In October 2026 Microsoft published twelve advisories for the .NET and ASP.NET Core runtimes that version 10.0.13 fixes. The Orchestrator image — BROKA's API — of every version from 1.0.0 to 1.2.1 runs on .NET 10.0.12, so an image scanner reports all twelve there.

Component	CVE	Upstream severity	In BROKA
ASP.NET Core 10.0.12 (Kestrel)	CVE-2026-88092	Critical	reachable — see below
ASP.NET Core 10.0.12 (form reading)	CVE-2026-70181	High	reachable — see below
.NET 10.0.12 (date parsing)	CVE-2026-96233	High	reachable by a signed-in user — see below
ASP.NET Core 10.0.12 (Kestrel HTTP/2, HTTP/3)	CVE-2026-70188	Critical	not reachable
ASP.NET Core 10.0.12 (Kestrel HTTP/3)	CVE-2026-70186	High	not reachable
ASP.NET Core 10.0.12 (Blazor)	CVE-2026-70183	High	not present
ASP.NET Core 10.0.12 (Identity endpoints)	CVE-2026-70175	High	not reachable
ASP.NET Core 10.0.12 (request localization)	CVE-2026-96236	High	not reachable
.NET 10.0.12 (signed XML)	CVE-2026-58280, CVE-2026-69651	High	not reachable
.NET 10.0.12 (named mutexes, shared memory)	CVE-2026-96225, CVE-2026-96231	High	not reachable

Both editions are affected the same way: Community 1.0.0 through 1.2.1, and Commercial 1.0.1 through 1.2.1, the Commercial Linux package included. The broker service and console images carry no .NET.

The three that reach BROKA

A request hidden in a request body — CVE-2026-88092

When a client closes its connection while the server is still handling a request whose body it has not read, Kestrel can go on to process that body as a new request. The console's nginx closes its connection to the Orchestrator when the client goes, so a client can send a request with a second one inside its body and disconnect while the first is still running. The hidden request is processed but its response goes nowhere, it still needs credentials of its own to do anything a signed-out request cannot, and nginx opens a separate connection for each request, so no other user's request or response can be read or changed. What it gains is a request that skipped nginx: its client address can be made up, which the audit trail and the per-address sign-in limits then record.

Memory reserved for a multipart body — CVE-2026-70181

Reading a multipart form reserves a full buffer for each file section before it is filled, so a small request with many sections makes the server reserve far more memory than it was sent. The Orchestrator reads no form itself, but the framework reads one for an action that takes parameters when the request says it is a form. Without signing in this is limited to the sign-in, setup and token-refresh endpoints, which are limited per address; signed in, it reaches most actions. nginx caps a request at 16 MB, so the memory is held only while a request is being handled.

A crafted date — CVE-2026-96233

Parsing certain crafted dates writes past the end of a stack buffer, which can end the process. The Orchestrator parses the date filters of the audit trail, alert events and, in 1.2.x, the metric history this way, so a signed-in user who may read one of them can end the Orchestrator with a single request; it starts again on its own under every way BROKA ships. No endpoint that takes no session parses a date.

Why the other nine do not reach BROKA

• CVE-2026-70188 and CVE-2026-70186 are in Kestrel's HTTP/2 and HTTP/3 handling. The Orchestrator serves HTTP/1.1 only — a cleartext listener with Kestrel's default protocols — and is reached only through nginx, which speaks HTTP/1.1 to it and forwards no request trailers. HTTP/3 needs TLS and QUIC, which it never has.
• CVE-2026-70183 is in Blazor's authorization components; BROKA has no Blazor or Razor components.
• CVE-2026-70175 is in ASP.NET Core Identity's ready-made account endpoints and pages; BROKA maps none of them and has no self-service password reset.
• CVE-2026-96236 is in the request localization middleware, which BROKA does not use.
• CVE-2026-58280 and CVE-2026-69651 are in signed and encrypted XML processing, which BROKA never performs — the same ground as BROKA-SA-2026-002.
• CVE-2026-96225 and CVE-2026-96231 need another local user to plant symbolic links in a shared temporary folder; the Orchestrator opens no named mutex or shared memory, and no other user shares its temporary directory.

What to do

Upgrade to 1.3.0 or later. It runs the Orchestrator on .NET 10.0.13, which fixes all twelve; an upgrade is new images and a restart, and the 1.3.0 release notes have the details. There is no setting that closes the three reachable ones in an earlier version.

Scanners that read OpenVEX can take this advisory's statements from the document linked on this page, which names each affected image by digest.

Timeline

• 2026-10-13: Microsoft publishes the advisories and .NET 10.0.13.
• 2026-10-14: the nightly scan of 1.2.1's published images reports all twelve.
• 2026-10-15: the Orchestrator's base images move to .NET 10.0.13 for the next release.
• 2026-10-16: 1.3.0 is released on .NET 10.0.13.
• 2026-10-23: each of the twelve is checked against BROKA as shipped.
• 2026-10-24: this advisory is published.