Dashboard / CVE-2026-97629

CVE-2026-97629

MEDIUM 1 PoC
MEDIUM Priority: 0.01 BB Relevance: 73/100
Published: 2026-10-14 Modified: 2026-10-29 First seen: 2026-10-29 Status: active

Attack Surface

Network No Auth No Interaction Conf. Impact

CVSS Vector Breakdown

AV: Network
AC: High
PR: None
UI: None
S: Unchanged
C: High
I: Low
A: None

Description

Description When NGINX Plus or NGINX Open Source is configured with ssl_session_cache shared:name:size without an explicit ssl_session_ticket_key file directives to automatically rotate SSL session ticket keys, a remote unauthenticated attacker is able to forge client SSL sessions in a non-deterministic manner that is beyond the attacker's control. An attacker could leverage this vulnerability to bypass verification of client certificates. Impact This vulnerability can lead to the exposure of resources or functionality to unintended actors, possibly providing attackers with access to sensitive information. There is no control plane exposure; this is a data plane issue only. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Weakness Classification (1)

Affected Software (1)

VendorProductVersion
F5 NGINX Plus 37.1.0 < 37.1.0.1

References & Advisories (1)

Proof of Concept (1)

—
https://github.com/PhiNode-Labs/nginx-cve-2026-97629
nomi-sec

Bug Bounty Relevance

73 / 100
✓ Network accessible
✓ No authentication
✓ No user interaction
✓ PoC available (1)

CVSS Score

6.5 / 10.0 v3.1
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N

EPSS — Exploitation Probability

0.23%
Raw Score 0.002300
Percentile 13.9%
Date 2026-10-29

Intelligence Sources

mitre ref →

External Links