{"id":"CVE-2026-95770","kind":"vulnerability","aliases":["CVE-2026-95770"],"related":[],"title":"HPE Networking Fabric Composer: OS flaw leaks sensitive information to local users","description":"A sensitive information disclosure vulnerability in the underlying operating system of HPE Networking Fabric Composer could allow an authenticated low-privileged user with local access to view sensitive information, if certain preconditions outside of the attacker's control are met. Successful exploitation could allow an attacker to obtain sensitive information from the affected system.","summary":"The underlying operating system of HPE Networking Fabric Composer exposes sensitive information to an authenticated, low-privileged user with local access. The sources say an attacker can obtain sensitive information from the affected system only if preconditions outside the attacker's control are met.","severity":"medium","cvss":4.7,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["hpe-networking-fabric-composer","infrastructure","self-hosted"],"not_affected_if":["no-local-low-privilege-accounts"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-03T20:18:25+00:00","first_seen_at":"2026-11-03T20:49:27+00:00","triaged_at":"2026-11-03T20:51:53+00:00","updated_at":"2026-11-03T20:51:53+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-11-03T20:51:53Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"HPE Networking Fabric Composer: OS flaw leaks sensitive information to local users","impact":"low","summary":"The underlying operating system of HPE Networking Fabric Composer exposes sensitive information to an authenticated, low-privileged user with local access. The sources say an attacker can obtain sensitive information from the affected system only if preconditions outside the attacker's control are met.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["hpe-networking-fabric-composer","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"local user reads sensitive system information from the host","analyst_note":"Find the affected HPE Networking Fabric Composer versions, the fixed release, and the preconditions named in the HPE advisory.","how_to_check":"unknown","plain_action":"","needs_analyst":true,"not_affected_if":["no-local-low-privilege-accounts"],"who_is_affected":"Teams that run HPE Networking Fabric Composer on their own hardware or virtual machines are the ones exposed, and only where a low-privileged local account exists on the host. The sources do not list affected versions or the preconditions in detail. Systems where only the vendor operates the platform are not in scope for the local team.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000661,"input_tokens":4133,"output_tokens":496,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-95770':15A,18A 'access':49B,98C 'affect':61B,126C 'allow':89C,117C 'attack':54B,68B,109C,119C 'authent':42B,91C 'certain':104C 'compos':4A,23B,36B,87C 'control':70B,111C 'could':88C,116C 'cve':13A,16A 'disclosur':76C 'exploit':115C 'expos':37B 'fabric':3A,22B,35B,86C 'flaw':6A 'host':27B 'hpe':1A,20B,33B,84C 'hpe-networking-fabric-compos':19B 'inform':9A,39B,58B,75C,102C,123C 'infrastructur':24B 'leak':7A 'local':11A,48B,97C 'low':44B,93C 'low-privileg':43B,92C 'met':72B,113C 'network':2A,21B,34B,85C 'obtain':56B,121C 'oper':30B,81C 'os':5A 'outsid':66B,106C 'precondit':65B,105C 'privileg':45B,94C 'say':52B 'self':26B 'self-host':25B 'sensit':8A,38B,57B,74C,101C,122C 'sourc':51B 'success':114C 'system':31B,62B,82C,127C 'under':29B,80C 'user':12A,46B,95C 'view':100C 'vulner':77C","nicknames":[],"mitigations":[],"who_affected":"Teams that run HPE Networking Fabric Composer on their own hardware or virtual machines are the ones exposed, and only where a low-privileged local account exists on the host. The sources do not list affected versions or the preconditions in detail. Systems where only the vendor operates the platform are not in scope for the local team.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["hpenetworkingfabriccomposer","infrastructure","medium","selfhosted"],"campaign_type":null,"first_public_at":"2026-11-03T20:18:25+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","cvss_by":"security-alert@hpe.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-95770","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-95770","severity":null,"published_at":"2026-11-03T20:18:25+00:00","modified_at":"2026-11-03T20:30:24+00:00","first_seen_at":"2026-11-03T20:49:27+00:00","fetched_at":"2026-11-03T20:49:27+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}