CVE-2026-91768

MediumCVSS 6.5/10Last modified Sep 29, 2026

Description

The IPv6 branch of the FastCGI client access check compares only the first 12 bytes of a 16-byte IPv6 address, so listen.allowed_clients matches on a /96 prefix instead of the exact address. An attacker who can source an address sharing the first 96 bits with an allowed one passes the check and reaches the FastCGI endpoint.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-1023

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published: Sep 25, 2026
Last modified: Sep 29, 2026
NVD status: Undergoing Analysis

Related CVEs from 2026

CVE-2026-917694.3PHP's OpenSSL stream peer verification checks the certificate's subjectAltName entries first and, whenever no entry matches, falls back to t CVE-2026-91779.4A Server-Side Template Injection (SSTI) vulnerability was identified in the mail template functionality of the Axway SecureTransport produc CVE-2026-917706.5IceHRM before 36.0.0 fails to validate employee ownership on seven REST sub-resource endpoints, allowing authenticated employees to read any CVE-2026-917718.8Weights & Biases wandb before 0.29.0 fails to validate the file name from server responses in the File.download function, allowing path trav CVE-2026-917726.1Halo through 2.26.1 contains an open redirect vulnerability in the anonymous thumbnail endpoint that fails to validate the uri query paramet CVE-2026-917734.3Soft Serve versions 0.7.1 through 0.11.6 fail to scope Git LFS lock queries by repository, allowing authenticated users to read lock metadat CVE-2026-917744.3Yao through v1.0.0-rc22 authenticates but fails to authorize the GET /user/teams/:id endpoint, allowing any logged-in user to read full team CVE-2026-917757.4LimeSurvey Community Edition 7.0.14 fails to safely encode attacker-controlled content from a crafted .lss survey file when displaying impor CVE-2026-917767.5TypeDeserializerBase._findDeserializer() in FasterXML jackson-databind caches the resolved deserializer under the raw, attacker-supplied typ CVE-2026-917777.5Forward-reference completion for @JsonIdentityInfo object IDs in FasterXML jackson-databind performs a linear scan of the pending-reference CVE-2026-917787.2In affected versions of Octopus Server, users with certain scoped permission sets could execute arbitrary scripts on a worker (including the CVE-2026-917793.3A security flaw has been discovered in GNU Binutils 2.47. This affects the function _bfd_elf_eh_frame_section_offset of the file bfd/elf-eh-