---
id: "CVE-2026-95769"
kind: "vulnerability"
aliases: ["CVE-2026-95769"]
title: "HPE Networking Fabric Composer: API lets attackers forge audit log client addresses"
severity: "medium"
cvss: 5.3
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["fabric-composer", "hpe", "infrastructure", "networking"]
not_affected_if: ["api-not-exposed"]
published_at: "2026-11-03T20:18:25+00:00"
first_seen_at: "2026-11-03T20:49:27+00:00"
updated_at: "2026-11-03T20:51:50+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-95769", "first_seen_at": "2026-11-03T20:49:27+00:00"}]
---

# HPE Networking Fabric Composer: API lets attackers forge audit log client addresses

An unauthenticated remote attacker can send API requests that make the client address recorded in Fabric Composer's audit logs false. The flaw lets an attacker hide or misattribute activity in the audit trail.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Confirm whether HPE Networking Fabric Composer is deployed and which version is running; the sources do not list affected versions.
- Check whether the API is reachable from untrusted networks.
- Review audit records for client addresses that do not match known hosts.

## Timeline

- 2026-11-03T20:49:27+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-95769

## From the sources

An audit log spoofing vulnerability exists in the API of HPE Networking Fabric Composer. Successful exploitation could allow an unauthenticated remote attacker to falsify the client address recorded in audit records.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_