CVE-2026-42946
Description
A flaw was found in the ngx_http_scgi_module and ngx_http_uwsgi_module modules of NGINX. When scgi_pass or uwsgi_pass is configured, an unauthenticated attacker able to intercept and modify network traffic via a Man-In-The-Middle (MITM) attack and control the responses from an upstream server may be able to read sensitive data from the worker process or cause a denial of service by forcing the process to restart.
Statement
To exploit this issue, an attacker needs to be able to control the responses from SCGI or uWSGI backend servers via a Man-In-The-Middle (MITM) attack, limiting its exposure. Also, this vulnerability allows an attacker to read sensitive data from the memory of the worker process or cause a denial of service by forcing the process to restart, but it cannot cause a complete system denial of service. Due to these reasons, this flaw has been rated with a moderate severity.
Mitigation
To mitigate this flaw, ensure that the connection between NGINX and the backend SCGI/uWSGI servers is fully encrypted and authenticated, preventing the interception and manipulation of responses required to exploit this vulnerability.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 7.4 | 7.4 | 6.5 |
| Attack Vector | Network | Network | Network |
| Attack Complexity | High | High | High |
| Privileges Required | None | None | None |
| User Interaction | None | None | None |
| Scope | Unchanged | Unchanged | Unchanged |
| Confidentiality | High | High | High |
| Integrity Impact | None | None | None |
| Availability Impact | High | High | Low |
Vector
Red Hat: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H
NVD: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H
cve.org: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:L
Understanding the Weakness (CWE)
Confidentiality
Technical Impact: Read Memory
If the untrusted pointer is used in a read operation, an attacker might be able to read sensitive portions of memory.
Availability
Technical Impact: DoS: Crash, Exit, or Restart
If the untrusted pointer references a memory location that is not accessible to the program, or points to a location that is "malformed" or larger than expected by a read or write operation, the application may terminate unexpectedly.
Integrity,Confidentiality,Availability
Technical Impact: Execute Unauthorized Code or Commands; Modify Memory
If the untrusted pointer is used in a function call, or points to unexpected data in a write operation, then code execution may be possible.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
