CVE-2026-97629
Description
A flaw was found in nginx. Under specific configurations where shared SSL session caching is enabled without explicit session ticket key rotation, a remote unauthenticated attacker may be able to forge client Secure Sockets Layer (SSL) sessions. This flaw allows an attacker to bypass client certificate verification and gain unauthorized access to protected resources and sensitive information.
Statement
A flaw was found in NGINX core SSL session handling. When configured with shared SSL session caching (ssl_session_cache shared:...) without explicit session ticket key rotation directives (ssl_session_ticket_key), automatic ticket key management allows client SSL session forgery in a non-deterministic manner. A remote unauthenticated attacker can exploit this condition to forge session tickets, bypassing client certificate verification (mTLS) to gain unauthorized access to protected upstream resources. Default SELinux policies and unprivileged worker confinement prevent process escape, restricting exposure entirely to the TLS termination layer.
Mitigation
Disable TLS session tickets by specifying ssl_session_tickets off; within the server or http configuration blocks. Alternatively, configure the ssl_session_ticket_key directive to point to a managed key file and rotate the secret out-of-band.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 6.5 | N/A | 6.5 |
| Attack Vector | Network | N/A | Network |
| Attack Complexity | High | N/A | High |
| Privileges Required | None | N/A | None |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | High | N/A | High |
| Integrity Impact | Low | N/A | Low |
| Availability Impact | None | N/A | None |
Vector
Red Hat: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N
cve.org: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
