CVE-2026-94584: Race Condition
A race condition and thread-safety vulnerability exists in the web management daemon of Brocade Fabric OS versions before 10.0.1. When handling user authentication requests across a multi-threaded execution pool, this race condition causes PAM modules to process stale or incorrect client IP addresses and switch context numbers. This leads to inaccurate audit records and potential access control bypasses where AAA evaluation or Calling-Station-ID ACL policies rely on client IP attributes.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Brocade Fabric OSto a version that resolves this vulnerability.Fixed in 10.0.1
Event History
Frequently Asked Questions
Which deployments are most exposed to an access control impact?
Deployments whose AAA evaluation or Calling-Station-ID ACL policies depend on the client IP address are the ones identified as potentially subject to access control bypass. Environments that use those attributes only for logging are primarily exposed to inaccurate audit records.
What conditions are required for exploitation?
The issue occurs while the web management daemon handles user authentication requests across its multi-threaded execution pool. The supplied CVSS vector indicates adjacent-network attack access, high attack complexity, low privileges required, and no user interaction.
Are default configurations known to be affected?
The available information does not state whether the affected IP-dependent AAA or Calling-Station-ID ACL policies are enabled by default. The described access-control risk depends on configurations that rely on client IP attributes.
What can be done before upgrading?
The provided information does not specify a workaround. To reduce the described access-control risk, avoid relying on client IP attributes in AAA evaluation or Calling-Station-ID ACL policies until the device is updated.
How can administrators identify possible impact?
Review web-management authentication audit records for client IP addresses or switch context numbers that do not match the actual connecting client or expected context. Also identify AAA and Calling-Station-ID ACL policies that use client IP attributes, since those are the policies described as potentially bypassable.