{"id":"CVE-2026-95767","kind":"vulnerability","aliases":["CVE-2026-95767"],"related":[],"title":"HPE Fabric Composer API leaks sensitive system information without authentication","description":"An unauthenticated information disclosure vulnerability exists in the API of HPE Networking Fabric Composer. Successful exploitation could allow an unauthenticated remote attacker to obtain sensitive information about the affected system.","summary":"The API of HPE Networking Fabric Composer exposes sensitive information about the system to anyone who can reach it, without logging in. An unauthenticated remote attacker can read that data, which may help plan further attacks.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["fabric-composer","hpe","infrastructure","networking"],"not_affected_if":["api-not-reachable-externally"],"how_to_check":"- Confirm whether HPE Networking Fabric Composer is installed in your environment.\n- Check the product's version against the affected ranges in the HPE advisory (unknown from the sources).\n- Check whether the Fabric Composer API is reachable from networks outside your management network (unknown from the sources).","fix":null,"status":"open","published_at":"2026-11-03T20:18:25+00:00","first_seen_at":"2026-11-03T20:49:27+00:00","triaged_at":"2026-11-03T20:51:50+00:00","updated_at":"2026-11-03T20:51:50+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-11-03T20:51:50Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"HPE Fabric Composer API leaks sensitive system information without authentication","impact":"low","summary":"The API of HPE Networking Fabric Composer exposes sensitive information about the system to anyone who can reach it, without logging in. An unauthenticated remote attacker can read that data, which may help plan further attacks.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["hpe","fabric-composer","networking"],"confidence":0.5,"fix_status":"unknown","needs_auth":"no","worst_case":"Sensitive system information is read by an unauthenticated remote attacker","analyst_note":"Find the HPE advisory for CVE-2026-95767 to get affected versions, fixed versions and the exact data exposed.","how_to_check":"- Confirm whether HPE Networking Fabric Composer is installed in your environment.\n- Check the product's version against the affected ranges in the HPE advisory (unknown from the sources).\n- Check whether the Fabric Composer API is reachable from networks outside your management network (unknown from the sources).","plain_action":"","needs_analyst":true,"not_affected_if":["api-not-reachable-externally"],"who_is_affected":"Teams that run HPE Networking Fabric Composer and expose its API to a network an attacker can reach. The sources do not name affected versions or the exact data exposed, so whether a given deployment is affected is unknown. Deployments where the API is limited to a trusted management network are less exposed.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000689,"input_tokens":4098,"output_tokens":559,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-95767':13A,16A 'affect':87C 'allow':76C 'anyon':37B 'api':4A,24B,67C 'attack':48B,58B,80C 'authent':10A 'compos':3A,19B,29B,72C 'could':75C 'cve':11A,14A 'data':52B 'disclosur':62C 'exist':64C 'exploit':74C 'expos':30B 'fabric':2A,18B,28B,71C 'fabric-compos':17B 'help':55B 'hpe':1A,20B,26B,69C 'inform':8A,32B,61C,84C 'infrastructur':21B 'leak':5A 'log':43B 'may':54B 'network':22B,27B,70C 'obtain':82C 'plan':56B 'reach':40B 'read':50B 'remot':47B,79C 'sensit':6A,31B,83C 'success':73C 'system':7A,35B,88C 'unauthent':46B,60C,78C 'vulner':63C 'without':9A,42B","nicknames":[],"mitigations":[],"who_affected":"Teams that run HPE Networking Fabric Composer and expose its API to a network an attacker can reach. The sources do not name affected versions or the exact data exposed, so whether a given deployment is affected is unknown. Deployments where the API is limited to a trusted management network are less exposed.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["fabriccomposer","hpe","infrastructure","medium","networking"],"campaign_type":null,"first_public_at":"2026-11-03T20:18:25+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","cvss_by":"security-alert@hpe.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-95767","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-95767","severity":null,"published_at":"2026-11-03T20:18:25+00:00","modified_at":"2026-11-03T20:30:24+00:00","first_seen_at":"2026-11-03T20:49:27+00:00","fetched_at":"2026-11-03T20:49:27+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}