Potential.NET SDK Container Build Tampering Vulnerability: Early Warning
An early warning has been issued regarding a potential tampering vulnerability in the.NET SDK container image build process, which could allow a local attacker to inject resources into container images. This reportedly affects Microsoft .NET projects using the Microsoft.NET.Build.Containers package.
What happened
According to the Microsoft Security Advisory CVE-2026-50526, a tampering vulnerability has been identified in the.NET SDK container image build process. This vulnerability could potentially allow a local attacker to inject resources into container images. The affected component is the Microsoft.NET.Build.Containers package, specifically versions >=10.0.0,<=10.0.9, >=9.0.0,<=9.0.17, and >=8.0.0,<=8.0.28.
To assess your exposure, check if your projects are using the Microsoft.NET.Build.Containers package within the affected version ranges. If so, it is recommended to upgrade to the patched versions: 10.0.10 for.NET 10.0, 9.0.18 for.NET 9.0, and 8.0.29 for.NET 8.0. The severity of this issue is currently under investigation, but it is advised to take precautionary measures.
For more detailed information, consult the primary sources, particularly the Microsoft Security Advisory CVE-2026-50526 –.NET Tampering Vulnerability available on GitHub. This advisory provides further insights into the vulnerability and the recommended actions to mitigate potential risks.
How 0Day mitigates this
Microsoft.NET.Build.Containers is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.