---
id: "CVE-2026-95734"
kind: "vulnerability"
aliases: ["CVE-2026-95734"]
title: "HPE Fabric Composer API lets low-privilege users read stored credentials"
severity: "high"
cvss: 8.8
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "Fabric Composer", "fixed": ["7.3.5", "7.4.1"], "affected": "<= 7.3.4 (7.3.x); <= 7.4.0 (7.4.x)", "ecosystem": "vendor"}]
ecosystems: []
tags: ["api", "fabric-composer", "hpe", "infrastructure", "network-fabric", "self-hosted"]
not_affected_if: ["management-interface-isolated", "unknown"]
published_at: "2026-11-03T20:18:21+00:00"
first_seen_at: "2026-11-03T20:49:24+00:00"
updated_at: "2026-11-03T21:00:08+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-95734", "first_seen_at": "2026-11-03T20:49:24+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-11-03T21:00:08+00:00"}]
---

# HPE Fabric Composer API lets low-privilege users read stored credentials

HPE Networking Fabric Composer's API exposes data beyond what a low-privileged user is authorized to see. An attacker with a basic authenticated account can obtain sensitive credentials stored on the system.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Fabric Composer affected <= 7.3.4 (7.3.x); <= 7.4.0 (7.4.x) fixed 7.3.5, 7.4.1

## How to check

Check the installed HPE Networking Fabric Composer version: 7.4.0 and below, or 7.3.4 and below, is affected. Fixed: 7.4.1+ / 7.3.5+. Also check who holds low-privilege accounts and whether the API is reachable from untrusted networks.

## Fix

Upgrade Fabric Composer to 7.4.1 or later (7.4.x) or 7.3.5 or later (7.3.x), from the HPE Networking Support Portal. HPE workaround: restrict CLI and web management interfaces to a dedicated layer 2 segment/VLAN and/or firewall them at layer 3+, with accounting controls. After patching, consider rotating credentials stored on the system, since a low-privileged user could have read them.

## Timeline

- 2026-11-03T20:49:24+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-95734
- 2026-11-03T21:00:08+00:00 analyst — Read HPE advisory HPESBNW05172 (2026-Nov-03): CVE-2026-95734 authenticated info disclosure in API, CVSS 8.8, affected <=7.3.4/<=7.4.0, fixed 7.3.5/7.4.1. HPE not aware of exploit. Workaround is the management-interface restriction.

## Documents

- [advisory] HPESBNW05172 rev.1 - Multiple Vulnerabilities in HPE Networking Fabric Composer (AFC) https://csaf.arubanetworking.hpe.com/2026/hpe_networking_-_hpesbnw05172.txt

## From the sources

A sensitive information disclosure vulnerability in the API of HPE Networking Fabric Composer could allow an authenticated low-privileged user to access sensitive information beyond what is authorized by the user's existing privilege level. Successful exploitation could allow an attacker to obtain sensitive credentials stored on the affected system.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_