Incorrect authorization in NGINX Plus and NGINX Open Source - CVE-2026-28755

Vulnerability identifier: #VU124470

CSH Severity: Medium

CVSS v4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]

CVE-ID: CVE-2026-28755

CWE-ID: CWE-863

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to bypass implemented security restrictions.

The vulnerability exists due to improper handling of revoked certificates in the ngx_stream_ssl_module module when configured with the ssl_verify_client on and ssl_ocsp on directives. A remote attacker can bypass authorization checks and access application data with a revoked certificate. 

NGINX Plus
NGINX Open Source
Fedora
nginx-mod-vts
nginx-mod-fancyindex
nginx-mod-headers-more
nginx-mod-brotli
nginx-mod-modsecurity
nginx-mod-naxsi
nginx

Install updates from vendor's website.

NGINX Plus - addressed in versions R32 P5, R35 P2, R36 P3
NGINX Open Source - addressed in versions 1.28.3, 1.29.7
nginx-mod-vts - update to 0.2.4-7.fc44
nginx-mod-fancyindex - update to 0.6.0-2.fc44
nginx-mod-headers-more - update to 0.39-7.fc44
nginx-mod-brotli - update to 1.0.0~rc-7.fc44
nginx-mod-modsecurity - update to 1.0.4-8.fc44
nginx-mod-naxsi - update to 1.6-15.fc44
nginx - update to 1.28.3-1.fc44

• https://my.f5.com/manage/s/article/K000160368

• Multiple vulnerabilities in NGINX Open Source and NGINX Plus
• Fedora 44 update for nginx, nginx-mod-brotli, nginx-mod-fancyindex, nginx-mod-headers-more, nginx-mod-modsecurity, nginx-mod-naxsi, nginx-mod-vts