{"id":"CVE-2026-95758","kind":"vulnerability","aliases":["CVE-2026-95758"],"related":[],"title":"HPE Networking Fabric Composer: API authorization bypass lets users change protected resources","description":"An authorization bypass vulnerability exists in the API of HPE Networking Fabric Composer. Successful exploitation could allow an authenticated attacker to bypass security restrictions and modify protected resources on the affected system.","summary":"HPE Networking Fabric Composer has an authorization bypass in its API. An authenticated attacker can get around security restrictions and modify resources they should not be able to change.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["fabric-composer","hpe","infrastructure","networking"],"not_affected_if":["unknown"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-03T20:18:24+00:00","first_seen_at":"2026-11-03T20:49:26+00:00","triaged_at":"2026-11-03T20:50:27+00:00","updated_at":"2026-11-03T20:50:27+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-11-03T20:50:27Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"HPE Networking Fabric Composer: API authorization bypass lets users change protected resources","impact":"medium","summary":"HPE Networking Fabric Composer has an authorization bypass in its API. An authenticated attacker can get around security restrictions and modify resources they should not be able to change.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["hpe","fabric-composer","networking"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"authenticated user modifies protected resources on the system","analyst_note":"Find the HPE security bulletin for CVE-2026-95758 to get affected and fixed versions and API exposure details.","how_to_check":"unknown","plain_action":"","needs_analyst":true,"not_affected_if":["unknown"],"who_is_affected":"Teams running HPE Networking Fabric Composer with API access enabled. The sources do not say which versions are affected or which configurations expose the API, so check the vendor advisory for version ranges.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000614,"input_tokens":4091,"output_tokens":409,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-95758':15A,18A 'abl':51B 'affect':84C 'allow':70C 'api':5A,35B,61C 'around':41B 'attack':38B,73C 'authent':37B,72C 'author':6A,31B,55C 'bypass':7A,32B,56C,75C 'chang':10A,53B 'compos':4A,21B,28B,66C 'could':69C 'cve':13A,16A 'exist':58C 'exploit':68C 'fabric':3A,20B,27B,65C 'fabric-compos':19B 'get':40B 'hpe':1A,22B,25B,63C 'infrastructur':23B 'let':8A 'modifi':45B,79C 'network':2A,24B,26B,64C 'protect':11A,80C 'resourc':12A,46B,81C 'restrict':43B,77C 'secur':42B,76C 'success':67C 'system':85C 'user':9A 'vulner':57C","nicknames":[],"mitigations":[],"who_affected":"Teams running HPE Networking Fabric Composer with API access enabled. The sources do not say which versions are affected or which configurations expose the API, so check the vendor advisory for version ranges.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["fabriccomposer","hpe","infrastructure","medium","networking"],"campaign_type":null,"first_public_at":"2026-11-03T20:18:24+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","cvss_by":"security-alert@hpe.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-95758","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-95758","severity":null,"published_at":"2026-11-03T20:18:24+00:00","modified_at":"2026-11-03T20:30:24+00:00","first_seen_at":"2026-11-03T20:49:26+00:00","fetched_at":"2026-11-03T20:49:26+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}