---
id: "CVE-2026-95751"
kind: "vulnerability"
aliases: ["CVE-2026-95751"]
title: "HPE Networking Fabric Composer: API certificate check flaw lets attackers bypass login"
severity: "high"
cvss: 7.4
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["api", "auth-bypass", "hpe-networking-fabric-composer", "infrastructure", "unauthenticated"]
not_affected_if: []
published_at: "2026-11-03T20:18:23+00:00"
first_seen_at: "2026-11-03T20:49:26+00:00"
updated_at: "2026-11-03T20:53:01+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-95751", "first_seen_at": "2026-11-03T20:49:26+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-11-03T20:53:01+00:00"}]
---

# HPE Networking Fabric Composer: API certificate check flaw lets attackers bypass login

HPE Networking Fabric Composer's API does not properly validate certificates, so an attacker can get past existing authentication controls. Successful exploitation gives unauthorized access to the affected system.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

Unknown: HPE's advisory for this CVE was not found. Check your Fabric Composer version in the UI/About page and compare with the HPE advisory once published; the earlier advisory HPESBNW05133 covered 7.3.3 and below, but it does not list this CVE.

## Timeline

- 2026-11-03T20:49:26+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-95751
- 2026-11-03T20:53:01+00:00 analyst — HPE's per-CVE bulletin for this Nov 3 batch not found (web search, guessed CSAF URLs 05166-05169 empty). Sept advisory HPESBNW05133 (7.3.3 and below; fixed 7.3.4 / 7.4.0) does NOT list this CVE, so I did not apply its versions. Only the HPE advance notice (no CVE detail) is linked as mentions. Nothing verified. Revisit when the HPE advisory (likely HPESBNW05167+) is indexed.

## Documents

- [mentions] HPESBNW05166 rev.1 - HPE Networking Advance Notification of Security Advisories for November 03, 2026 https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05166en_us&docLocale=en_US

## From the sources

An improper certificate validation vulnerability in the API of HPE Networking Fabric Composer could allow an unauthenticated remote attacker to circumvent existing authentication controls if certain preconditions outside of the attacker's control are met. Successful exploitation could allow an attacker to gain unauthorized access to the affected system.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_