{"id":"CVE-2026-95769","kind":"vulnerability","aliases":["CVE-2026-95769"],"related":[],"title":"HPE Networking Fabric Composer: API lets attackers forge audit log client addresses","description":"An audit log spoofing vulnerability exists in the API of HPE Networking Fabric Composer. Successful exploitation could allow an unauthenticated remote attacker to falsify the client address recorded in audit records.","summary":"An unauthenticated remote attacker can send API requests that make the client address recorded in Fabric Composer's audit logs false. The flaw lets an attacker hide or misattribute activity in the audit trail.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["fabric-composer","hpe","infrastructure","networking"],"not_affected_if":["api-not-exposed"],"how_to_check":"- Confirm whether HPE Networking Fabric Composer is deployed and which version is running; the sources do not list affected versions.\n- Check whether the API is reachable from untrusted networks.\n- Review audit records for client addresses that do not match known hosts.","fix":null,"status":"open","published_at":"2026-11-03T20:18:25+00:00","first_seen_at":"2026-11-03T20:49:27+00:00","triaged_at":"2026-11-03T20:51:50+00:00","updated_at":"2026-11-03T20:51:50+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-11-03T20:51:50Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"HPE Networking Fabric Composer: API lets attackers forge audit log client addresses","impact":"low","summary":"An unauthenticated remote attacker can send API requests that make the client address recorded in Fabric Composer's audit logs false. The flaw lets an attacker hide or misattribute activity in the audit trail.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["hpe","fabric-composer","networking"],"confidence":0.5,"fix_status":"unknown","needs_auth":"no","worst_case":"audit records show false client addresses, hiding attacker activity","analyst_note":"Find the affected version range and HPE's advisory for CVE-2026-95769 at the NVD page, since the sources give neither.","how_to_check":"- Confirm whether HPE Networking Fabric Composer is deployed and which version is running; the sources do not list affected versions.\n- Check whether the API is reachable from untrusted networks.\n- Review audit records for client addresses that do not match known hosts.","plain_action":"","needs_analyst":true,"not_affected_if":["api-not-exposed"],"who_is_affected":"Teams running HPE Networking Fabric Composer with its API exposed to a network the attacker can reach. The sources do not give affected versions or the vendor fix, so the exposed range is unknown. Teams that do not run this product can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000672,"input_tokens":4090,"output_tokens":525,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-95769':15A,18A 'activ':54B 'address':12A,37B,85C 'allow':76C 'api':5A,31B,67C 'attack':7A,28B,50B,80C 'audit':9A,43B,57B,60C,88C 'client':11A,36B,84C 'compos':4A,21B,41B,72C 'could':75C 'cve':13A,16A 'exist':64C 'exploit':74C 'fabric':3A,20B,40B,71C 'fabric-compos':19B 'fals':45B 'falsifi':82C 'flaw':47B 'forg':8A 'hide':51B 'hpe':1A,22B,69C 'infrastructur':23B 'let':6A,48B 'log':10A,44B,61C 'make':34B 'misattribut':53B 'network':2A,24B,70C 'record':38B,86C,89C 'remot':27B,79C 'request':32B 'send':30B 'spoof':62C 'success':73C 'trail':58B 'unauthent':26B,78C 'vulner':63C","nicknames":[],"mitigations":[],"who_affected":"Teams running HPE Networking Fabric Composer with its API exposed to a network the attacker can reach. The sources do not give affected versions or the vendor fix, so the exposed range is unknown. Teams that do not run this product can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["fabriccomposer","hpe","infrastructure","medium","networking"],"campaign_type":null,"first_public_at":"2026-11-03T20:18:25+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","cvss_by":"security-alert@hpe.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-95769","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-95769","severity":null,"published_at":"2026-11-03T20:18:25+00:00","modified_at":"2026-11-03T20:30:24+00:00","first_seen_at":"2026-11-03T20:49:27+00:00","fetched_at":"2026-11-03T20:49:27+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}