CVE-2026-41954: Information Disclosure Vulnerability

CVE-2026-41954 Overview

CVE-2026-41954 is a sensitive information disclosure vulnerability affecting an undisclosed F5 BIG-IP iControl REST endpoint and TMOS Shell (tmsh) command. An authenticated attacker holding the resource administrator role can leverage either interface to view sensitive information that should remain protected. The flaw maps to CWE-200: Exposure of Sensitive Information to an Unauthorized Actor. F5 notes that software versions which have reached End of Technical Support (EoTS) were not evaluated. The vulnerability requires high privileges and network access but no user interaction, and it impacts confidentiality without affecting integrity or availability.

Critical Impact
Authenticated resource administrators can extract sensitive configuration data from BIG-IP devices through either the iControl REST API or the tmsh interface, expanding the blast radius of any compromised admin credential.

Affected Products

F5 BIG-IP (specific versions enumerated in F5 Security Advisory K32950402)
F5 iControl REST API component
F5 TMOS Shell (tmsh) command interface

Discovery Timeline

2026-05-13 - CVE CVE-2026-41954 published to NVD
2026-05-13 - Last updated in NVD database

Technical Details for CVE-2026-41954

Vulnerability Analysis

The defect resides in two administrative surfaces of the F5 BIG-IP platform: an undisclosed iControl REST endpoint and a corresponding tmsh command. Both interfaces fail to redact or restrict sensitive information when invoked by an account assigned the resource administrator role. The resource administrator role is intended to manage routing, virtual servers, and traffic profiles, not to access secrets stored elsewhere on the system.

Because the interfaces return sensitive data directly in their responses, a successful query yields the secret material to the calling principal without additional escalation. The vulnerability is exposed over the management network where iControl REST and tmsh typically listen, which is why the attack vector is classified as network reachable. No user interaction is needed once the attacker holds valid credentials.

Root Cause

The root cause is improper enforcement of least-privilege output filtering [CWE-200]. The affected endpoint and command return data fields that fall outside the resource administrator role's authorization boundary. F5's published advisory K32950402 documents the affected versions and the corrective behavior introduced by the fix.

Attack Vector

An attacker first obtains credentials for an account bound to the resource administrator role, for example through credential reuse, phishing, or lateral movement from another administrative host. The attacker then issues an authenticated request to the affected iControl REST endpoint over HTTPS or executes the equivalent tmsh command after logging into the BIG-IP management shell. The response contains sensitive information that the role should not be permitted to read.

No verified public proof-of-concept exists at the time of writing. Refer to the F5 Security Advisory K32950402 for the exact endpoint, command, and versions involved.

Detection Methods for CVE-2026-41954

Indicators of Compromise

Authenticated iControl REST requests from resource administrator accounts to administrative endpoints that historically were not part of that role's workflow.
Interactive tmsh sessions initiated by resource administrator accounts that execute commands outside their documented job function.
Repeated or scripted queries against the same iControl REST URI from a single source IP or API token.

Detection Strategies

Enable iControl REST audit logging and forward HTTPS access logs from the BIG-IP management interface to a central SIEM for analysis.
Baseline normal API and tmsh activity per role, then alert on resource administrator accounts deviating from that baseline.
Correlate BIG-IP authentication events with downstream use of any credentials, certificates, or keys that were exposed by the affected endpoint.

Monitoring Recommendations

Restrict the BIG-IP management plane to a dedicated jump network and monitor all ingress to that network.
Review the assignment of the resource administrator role quarterly and revoke unused accounts.
Alert on creation of new resource administrator users or sudden role changes within the BIG-IP user database.

How to Mitigate CVE-2026-41954

Immediate Actions Required

Apply the fixed software versions listed in the F5 Security Advisory K32950402 as soon as a maintenance window allows.
Audit all accounts holding the resource administrator role and remove any that are not strictly required.
Rotate credentials, API tokens, and certificates that may have been exposed through the affected interfaces.

Patch Information

F5 has published remediation guidance in advisory K32950402. Customers running supported BIG-IP versions should upgrade to a release that includes the fix. Versions that have reached End of Technical Support are not evaluated by F5 and should be retired or replaced.

Workarounds

Limit iControl REST and tmsh access to a restricted management network reachable only by trusted administrators.
Apply the principle of least privilege by replacing resource administrator assignments with narrower custom roles where feasible.
Enforce multi-factor authentication on all BIG-IP administrative accounts to reduce the likelihood of credential compromise.

bash

# Review BIG-IP users and their assigned roles
tmsh list auth user

# Restrict iControl REST to a management VLAN (example)
tmsh modify sys httpd allow replace-all-with { 10.0.0.0/24 }
tmsh save sys config