Is CVE-2026-91768 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-91768?

CVE-2026-91768 has a CVSS v3 severity of MEDIUM (6.5).

Back

CVE-2026-91768

Description

The IPv6 branch of the FastCGI client access check compares only the first 12 bytes of a 16-byte IPv6 address, so listen.allowed_clients matches on a /96 prefix instead of the exact address. An attacker who can source an address sharing the first 96 bits with an allowed one passes the check and reaches the FastCGI endpoint.