CVE-2026-40435: httpd Auth Bypass Vulnerability

CVE-2026-40435 Overview

CVE-2026-40435 affects F5 httpd configurations where IP-based access restrictions fail to cover all endpoints. Connections from blocked source addresses can reach endpoints that should be gated by the IP allow-list. This represents an unprotected alternate channel weakness classified under [CWE-420]. The vulnerability is network-exploitable, requires no authentication, and no user interaction. F5 documents the issue in advisory K000156604. Software versions that have reached End of Technical Support (EoTS) were not evaluated by the vendor.

Critical Impact
Attackers from networks intended to be blocked can reach httpd endpoints, undermining a defense-in-depth control that operators rely on to limit management plane exposure.

Affected Products

F5 products exposing httpd with IP-based access restrictions configured
See vendor advisory K000156604 for the authoritative version matrix
EoTS versions were not evaluated and may also be affected

Discovery Timeline

2026-05-13 - CVE CVE-2026-40435 published to NVD
2026-05-13 - Last updated in NVD database

Technical Details for CVE-2026-40435

Vulnerability Analysis

The flaw resides in how httpd enforces IP-based access restrictions. Administrators configure these restrictions to ensure that only approved source addresses can interact with the web server. The enforcement, however, is not applied uniformly across every endpoint exposed by httpd. Specific endpoints remain reachable from source addresses that the policy intends to block.

This is an unprotected alternate channel issue. The primary access path enforces the allow-list, while a secondary path does not. Attackers can use the unprotected path to reach functionality that operators believed was gated. The exposure is limited to confidentiality impact on the affected component, with no direct integrity or availability impact reflected in the vendor scoring.

Root Cause

The root cause is incomplete enforcement coverage. The access control logic that filters requests by source IP does not run for every endpoint that httpd serves. Some routes bypass the filter, either because they are handled by a different code path or because the matching rules do not include them.

Attack Vector

An attacker connects to the affected httpd service over the network from a source address that the administrator has placed on the deny list. The attacker targets one of the endpoints not covered by the IP filter. The request reaches the endpoint, and the server responds as if the source were permitted. No credentials, tokens, or user interaction are required.

No verified exploit code is available for CVE-2026-40435. See the vendor advisory K000156604 for technical specifics and the list of impacted endpoints.

Detection Methods for CVE-2026-40435

Indicators of Compromise

httpd access log entries showing successful responses to requests from source IPs explicitly listed in the deny configuration
Successful HTTP requests to management endpoints originating from networks outside the administrator-approved range
Repeated probing of httpd URIs from addresses that other services on the same host are rejecting

Detection Strategies

Compare httpd access logs against the configured IP allow-list and alert on any 2xx or 3xx responses from disallowed sources
Place a network sensor in front of the affected host and correlate observed flows with the documented allow-list policy
Baseline normal management traffic by source ASN and geography, then alert on deviations targeting httpd

Monitoring Recommendations

Forward httpd access and error logs to a central log platform and retain them long enough to support retrospective hunting
Monitor for unauthenticated requests to httpd endpoints documented in advisory K000156604
Track configuration drift on the device so that allow-list changes are reviewed and approved

How to Mitigate CVE-2026-40435

Immediate Actions Required

Review F5 advisory K000156604 and identify whether running versions are listed as affected
Upgrade to a fixed version published by F5 once the device has been confirmed eligible
Remove EoTS devices from internet-reachable paths, since those versions were not evaluated for this issue

Patch Information

F5 documents fix availability and the affected version matrix in security article K000156604. Apply the vendor-recommended upgrade as the primary remediation path.

Workarounds

Enforce the IP allow-list at a network layer in front of the device, using a firewall or load balancer, so that blocked sources cannot reach httpd at all
Restrict httpd to an out-of-band management interface that is not routable from untrusted networks
Disable any non-essential httpd features or endpoints until the patched version is deployed

bash

# Example upstream firewall enforcement (illustrative)
# Replace MGMT_IF and ALLOWED_CIDR with environment-specific values
iptables -A INPUT -i MGMT_IF -p tcp --dport 443 -s ALLOWED_CIDR -j ACCEPT
iptables -A INPUT -i MGMT_IF -p tcp --dport 443 -j DROP