CVE-2026-28755: F5 Nginx Plus Auth Bypass Vulnerability

CVE-2026-28755 Overview

CVE-2026-28755 is an authorization bypass vulnerability affecting F5 NGINX Plus and NGINX Open Source. The vulnerability exists in the ngx_stream_ssl_module module due to improper handling of revoked certificates when the server is configured with the ssl_verify_client on and ssl_ocsp on directives. This flaw allows a TLS handshake to succeed even after an OCSP (Online Certificate Status Protocol) check identifies a client certificate as revoked, effectively bypassing certificate revocation validation.

Critical Impact

Attackers with revoked client certificates can still establish authenticated TLS connections to NGINX servers, potentially gaining unauthorized access to protected resources and services.

Affected Products

• F5 NGINX Plus R33, R33-P1, R33-P2, R33-P3
• F5 NGINX Plus R34, R34-P1, R34-P2
• F5 NGINX Plus R35-P1, R36, R36-P1, R36-P2
• F5 NGINX Open Source (multiple versions)

Discovery Timeline

• 2026-03-24 - CVE-2026-28755 published to NVD
• 2026-03-26 - Last updated in NVD database

Technical Details for CVE-2026-28755

Vulnerability Analysis

This vulnerability falls under CWE-863 (Incorrect Authorization), where the NGINX stream SSL module fails to properly enforce certificate revocation status during client authentication. When an NGINX server is configured to verify client certificates via OCSP, the server queries an OCSP responder to check whether a presented client certificate has been revoked. However, due to a logic flaw in the ngx_stream_ssl_module, even when the OCSP response indicates the certificate is revoked, the TLS handshake is allowed to complete successfully.

The vulnerability is particularly concerning in environments that rely on client certificate authentication for access control, such as mutual TLS (mTLS) deployments protecting sensitive APIs, internal services, or administrative interfaces.

Root Cause

The root cause lies in the improper handling of OCSP response status within the ngx_stream_ssl_module. When processing the OCSP response that indicates a certificate has been revoked, the module fails to terminate the TLS handshake appropriately. Instead of rejecting the connection when a revoked certificate is detected, the handshake proceeds as if the certificate were valid. This represents a fundamental failure in the certificate validation logic path when both ssl_verify_client on and ssl_ocsp on directives are enabled simultaneously.

Attack Vector

The attack vector is network-based and requires an attacker to possess a client certificate that has been legitimately revoked. The attack scenario unfolds as follows:

1. An attacker obtains a valid client certificate for accessing a protected NGINX service
2. The certificate is subsequently revoked by the Certificate Authority (perhaps due to key compromise or policy violation)
3. Despite the revocation, the attacker presents the revoked certificate to the vulnerable NGINX server
4. The server queries the OCSP responder and receives confirmation that the certificate is revoked
5. Due to the vulnerability, NGINX ignores the revocation status and allows the connection
6. The attacker gains unauthorized access to resources protected by client certificate authentication

The vulnerability requires low privileges (a previously valid but now revoked certificate) and no user interaction, making it exploitable in automated attack scenarios.

Detection Methods for CVE-2026-28755

Indicators of Compromise

• Successful TLS connections from clients using certificates that should be revoked according to OCSP responders
• Discrepancies between OCSP revocation logs showing revoked certificates and NGINX access logs showing successful connections from those same certificates
• Unusual access patterns from certificates that were previously decommissioned or reported as compromised

Detection Strategies

• Enable detailed SSL/TLS logging in NGINX to capture certificate serial numbers and OCSP validation results
• Cross-reference NGINX connection logs with Certificate Authority revocation lists and OCSP responder logs
• Implement network-level monitoring to detect connections using known-revoked certificate serial numbers
• Deploy SentinelOne Singularity to monitor for anomalous authentication patterns in protected services

Monitoring Recommendations

• Configure alerting for any OCSP queries returning "revoked" status followed by successful connection establishment
• Monitor the ngx_stream_ssl_module for abnormal behavior patterns indicating certificate validation bypass
• Establish baseline metrics for client certificate authentication and alert on deviations

How to Mitigate CVE-2026-28755

Immediate Actions Required

• Review NGINX configurations to identify deployments using ssl_verify_client on with ssl_ocsp on in stream contexts
• Consult the F5 Support Article K000160368 for vendor-specific guidance and patches
• Consider temporarily implementing additional authorization layers until patches are applied
• Audit access logs for any connections that may have exploited this vulnerability

Patch Information

F5 has released information regarding this vulnerability in their support knowledge base. Organizations should consult the official F5 security advisory for specific patch versions and upgrade paths. Ensure you upgrade to a version that addresses CVE-2026-28755, taking note that software versions which have reached End of Technical Support (EoTS) are not evaluated.

Workarounds

• Consider using CRL (Certificate Revocation List) validation as an alternative or supplementary mechanism to OCSP
• Implement application-layer authorization checks that do not solely rely on certificate validation
• Deploy a reverse proxy or Web Application Firewall in front of NGINX that can perform independent certificate revocation checking
• For critical systems, consider requiring additional authentication factors beyond client certificates until the patch is applied

# Example: Verify current NGINX configuration for vulnerable directives
grep -r "ssl_verify_client\|ssl_ocsp" /etc/nginx/

# Check if stream SSL module is in use
nginx -V 2>&1 | grep stream_ssl

# Review active connections for certificate information (requires debug logging)
tail -f /var/log/nginx/ssl_access.log | grep -i "ocsp\|revoked"