CVE-2026-87678: CRLF Injection
An input validation and output encoding vulnerability exists in the web management interface of Brocade Fabric OS versions before 10.0.1. When configuring Federated Authentication (FA), the system fails to sanitize the Identity Provider (IdP) issuer parameter. An authenticated administrator—or an attacker capable of supplying crafted FA configuration files during an import routine—can inject arbitrary web server directives. This can lead to service denial by preventing the web management daemon from starting, or potentially alter web server security controls.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Brocade Fabric OSto a version that resolves this vulnerability.Fixed in 10.0.1
Event History
Frequently Asked Questions
Who is exposed to this issue?
Systems running Brocade Fabric OS before 10.0.1 are affected where Federated Authentication is configured through the web management interface or FA configuration files are imported. Exploitation requires an authenticated administrator or someone able to provide a crafted FA configuration file for import.
Is this exploitable without administrative access?
The described direct configuration path requires authenticated administrator access. The alternative path depends on the attacker being able to supply a crafted Federated Authentication configuration file during an import routine.
What is the likely operational impact?
Injected web server directives can prevent the web management daemon from starting, causing denial of service for the web management interface. The issue may also allow alteration of web server security controls.
What should be prioritized if an immediate upgrade is not possible?
Restrict who has administrative access to the web management interface and who can provide Federated Authentication configuration files for import. Treat IdP issuer values and imported FA configuration files as untrusted input.