{"id":"CVE-2026-95734","kind":"vulnerability","aliases":["CVE-2026-95734"],"related":[],"title":"HPE Fabric Composer API lets low-privilege users read stored credentials","description":"A sensitive information disclosure vulnerability in the API of HPE Networking Fabric Composer could allow an authenticated low-privileged user to access sensitive information beyond what is authorized by the user's existing privilege level. Successful exploitation could allow an attacker to obtain sensitive credentials stored on the affected system.","summary":"HPE Networking Fabric Composer's API exposes data beyond what a low-privileged user is authorized to see. An attacker with a basic authenticated account can obtain sensitive credentials stored on the system.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Fabric Composer","fixed":["7.3.5","7.4.1"],"affected":"<= 7.3.4 (7.3.x); <= 7.4.0 (7.4.x)","ecosystem":"vendor"}],"ecosystems":[],"tags":["api","fabric-composer","hpe","infrastructure","network-fabric","self-hosted"],"not_affected_if":["management-interface-isolated","unknown"],"how_to_check":"Check the installed HPE Networking Fabric Composer version: 7.4.0 and below, or 7.3.4 and below, is affected. Fixed: 7.4.1+ / 7.3.5+. Also check who holds low-privilege accounts and whether the API is reachable from untrusted networks.","fix":"Upgrade Fabric Composer to 7.4.1 or later (7.4.x) or 7.3.5 or later (7.3.x), from the HPE Networking Support Portal. HPE workaround: restrict CLI and web management interfaces to a dedicated layer 2 segment/VLAN and/or firewall them at layer 3+, with accounting controls. After patching, consider rotating credentials stored on the system, since a low-privileged user could have read them.","status":"open","published_at":"2026-11-03T20:18:21+00:00","first_seen_at":"2026-11-03T20:49:24+00:00","triaged_at":"2026-11-03T20:49:42+00:00","updated_at":"2026-11-03T21:00:08+00:00","category":"infrastructure","confidence":0.9,"triage":{"at":"2026-11-03T20:49:42Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"HPE Fabric Composer API lets low-privilege users read stored credentials","impact":"high","summary":"HPE Networking Fabric Composer's API exposes data beyond what a low-privileged user is authorized to see. An attacker with a basic authenticated account can obtain sensitive credentials stored on the system.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["hpe","fabric-composer","network-fabric","api"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"Attacker reads stored credentials, exposing the affected system beyond its intended access","analyst_note":"Find affected and fixed versions and the vendor advisory for HPE Networking Fabric Composer; the NVD entry gives no product ranges.","how_to_check":"unknown","plain_action":"","needs_analyst":true,"not_affected_if":["unknown"],"who_is_affected":"Teams running HPE Networking Fabric Composer with the API reachable by authenticated low-privileged accounts are exposed. The sources do not list affected versions or configurations, so whether a given deployment is affected is unknown.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000638,"input_tokens":4129,"output_tokens":451,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find affected and fixed versions and the vendor advisory for HPE Networking Fabric Composer; the NVD entry gives no product ranges.","search":"'-2026':14A,17A '-95734':15A,18A 'access':89C 'account':58B 'affect':116C 'allow':81C,106C 'api':4A,21B,38B,74C 'attack':53B,108C 'authent':57B,83C 'author':49B,95C 'basic':56B 'beyond':41B,92C 'compos':3A,24B,36B,79C 'composer':20A 'could':80C,105C 'credenti':12A,62B,112C 'cve':13A,16A 'data':40B 'disclosur':70C 'exist':100C 'exploit':104C 'expos':39B 'fabric':2A,19A,23B,29B,35B,78C 'fabric-compos':22B 'host':32B 'hpe':1A,25B,33B,76C 'inform':69C,91C 'infrastructur':26B 'let':5A 'level':102C 'low':7A,45B,85C 'low-privileg':6A,44B,84C 'network':28B,34B,77C 'network-fabr':27B 'obtain':60B,110C 'privileg':8A,46B,86C,101C 'read':10A 'see':51B 'self':31B 'self-host':30B 'sensit':61B,68C,90C,111C 'store':11A,63B,113C 'success':103C 'system':66B,117C 'user':9A,47B,87C,98C 'vulner':71C","nicknames":[],"mitigations":[],"who_affected":"Anyone running HPE Networking Fabric Composer 7.4.0 or earlier, or 7.3.4 or earlier, where someone holds a low-privilege account that can reach the API. Such a user can read stored credentials beyond their permission level (CVSS 8.8). Unsupported (EoM/EoS) versions are presumed affected. HPE lists no exploit or public discussion as of 2026-11-03.","tier":"B","verified":{"fix":{"at":"2026-11-03T21:00:08Z","by":"analyst","doc":"https://csaf.arubanetworking.hpe.com/2026/hpe_networking_-_hpesbnw05172.txt","run_id":1552},"products":{"at":"2026-11-03T21:00:08Z","by":"analyst","doc":"https://csaf.arubanetworking.hpe.com/2026/hpe_networking_-_hpesbnw05172.txt","run_id":1552},"workarounds":{"at":"2026-11-03T21:00:08Z","by":"analyst","doc":"https://csaf.arubanetworking.hpe.com/2026/hpe_networking_-_hpesbnw05172.txt","run_id":1552},"how_to_check":{"at":"2026-11-03T21:00:08Z","by":"analyst","doc":"https://csaf.arubanetworking.hpe.com/2026/hpe_networking_-_hpesbnw05172.txt","run_id":1552},"who_affected":{"at":"2026-11-03T21:00:08Z","by":"analyst","doc":"https://csaf.arubanetworking.hpe.com/2026/hpe_networking_-_hpesbnw05172.txt","run_id":1552}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["composer","fabriccomposer"],"ptokens":["composer","fabric"],"labels":["api","fabriccomposer","high","hpe","infrastructure","networkfabric","selfhosted"],"campaign_type":null,"first_public_at":"2026-11-03T20:18:21+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"security-alert@hpe.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-95734","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-95734","severity":null,"published_at":"2026-11-03T20:18:21+00:00","modified_at":"2026-11-03T20:30:24+00:00","first_seen_at":"2026-11-03T20:49:24+00:00","fetched_at":"2026-11-03T20:49:24+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-95734:1552","url":null,"severity":null,"published_at":"2026-11-03T21:00:08+00:00","modified_at":"2026-11-03T21:00:08+00:00","first_seen_at":"2026-11-03T21:00:08+00:00","fetched_at":"2026-11-03T21:00:08+00:00","note":"Read HPE advisory HPESBNW05172 (2026-Nov-03): CVE-2026-95734 authenticated info disclosure in API, CVSS 8.8, affected <=7.3.4/<=7.4.0, fixed 7.3.5/7.4.1. HPE not aware of exploit. Workaround is the management-interface restriction."}],"documents":[{"id":60639,"url":"https://csaf.arubanetworking.hpe.com/2026/hpe_networking_-_hpesbnw05172.txt","title":"HPESBNW05172 rev.1 - Multiple Vulnerabilities in HPE Networking Fabric Composer (AFC)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}