Session Forgery Vulnerability in NGINX Products by F5 Networks
CVE-2026-97629

8.3HIGH

Key Information:

Vendor

F5
Status
Nginx Plus
Nginx Open Source
Vendor
CVE Published:
14 October 2026

What is CVE-2026-97629?

A configuration issue in NGINX Plus and NGINX Open Source can allow a remote unauthenticated attacker to forge client SSL sessions. This occurs when the ssl_session_cache is set up without an ssl_session_ticket_key file directive. As a result, the vulnerability enables the attacker to bypass client certificate verification, leading to potential unauthorized access to sensitive resources. This is classified as a data plane issue, which means that the attack affects the transmission of data rather than the control plane.

Affected Version(s)

NGINX Open Source 1.31.0 < 1.31.7

NGINX Open Source 1.30.0 < 1.30.6

NGINX Open Source 1.23.3

References

https://my.f5.com/manage/s/article/K000162606
vendor-advisory

CVSS V4

Score:
8.3
Severity:
HIGH
Confidentiality:
High
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

F5 acknowledges PhiNode Labs for bringing this issue to our attention and following the highest standards of coordinated disclosure
.