CVE-2026-91768
Medium · 6.5CVSS
6.5
EPSS
0.6%
Published
Sep 25, 2026
CISA due date
—
The record
The IPv6 branch of the FastCGI client access check compares only the first 12 bytes of a 16-byte IPv6 address, so listen.allowed_clients matches on a /96 prefix instead of the exact address. An attacker who can source an address sharing the first 96 bits with an allowed one passes the check and reaches the FastCGI endpoint.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-81376 Incomplete comparison with missing factors in Visual Studio Code allows an unauthorized… CWE-1023
- CVE-2026-54713 CakePHP Queue is a queue-interop compatible queueing library. CWE-1023
- CVE-2026-53859 OpenClaw before 2026.5.26 contains a hostname validation vulnerability allowing attackers… CWE-1023
- CVE-2026-53839 OpenClaw before 2026.5.7 contains a hostname validation vulnerability in retry endpoint… CWE-1023
- CVE-2026-7473 On affected platforms running Arista EOS where a tunnel decapsulation configuration—such… CWE-1023
- CVE-2026-48587 An issue was discovered in Django 5.2 before 5.2.15 and 6.0 before 6.0.6. CWE-1023
- CVE-2026-4748 A regression in the way hashes were calculated caused rules containing the address range… CWE-1023
- GHSA-5jx8-q4cp-rhh6 jsrsasign: Incomplete Comparison Allows DSA Private Key Recovery via Biased Nonce… CWE-1023