---
id: "CVE-2026-95767"
kind: "vulnerability"
aliases: ["CVE-2026-95767"]
title: "HPE Fabric Composer API leaks sensitive system information without authentication"
severity: "medium"
cvss: 5.3
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["fabric-composer", "hpe", "infrastructure", "networking"]
not_affected_if: ["api-not-reachable-externally"]
published_at: "2026-11-03T20:18:25+00:00"
first_seen_at: "2026-11-03T20:49:27+00:00"
updated_at: "2026-11-03T20:51:50+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-95767", "first_seen_at": "2026-11-03T20:49:27+00:00"}]
---

# HPE Fabric Composer API leaks sensitive system information without authentication

The API of HPE Networking Fabric Composer exposes sensitive information about the system to anyone who can reach it, without logging in. An unauthenticated remote attacker can read that data, which may help plan further attacks.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Confirm whether HPE Networking Fabric Composer is installed in your environment.
- Check the product's version against the affected ranges in the HPE advisory (unknown from the sources).
- Check whether the Fabric Composer API is reachable from networks outside your management network (unknown from the sources).

## Timeline

- 2026-11-03T20:49:27+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-95767

## From the sources

An unauthenticated information disclosure vulnerability exists in the API of HPE Networking Fabric Composer. Successful exploitation could allow an unauthenticated remote attacker to obtain sensitive information about the affected system.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_