CVE-2026-87670

Executive Summary

CVE-2026-87670 is an authorization logic vulnerability (CWE-290 — Authentication Bypass by Spoofing) in the REST API gateway of Brocade Fabric OS versions prior to 10.0.1. The internal access control gate protecting restricted management endpoints relies solely on client-supplied HTTP headers, allowing any authenticated user holding a valid REST session — regardless of privilege level — to spoof those headers and bypass authorization controls. Successful exploitation exposes sensitive chassis metadata, hardware memory patrolling state, and firmware integrity audit logs to low-privilege users, representing a confidentiality-only impact with no public PoC, no Nuclei template, and no vendor fix currently tracked.

Technical Analysis

Brocade Fabric OS (FOS) is the firmware platform running on Brocade SAN switches and directors. It exposes a REST API gateway that serves both public and restricted management operations. According to the NVD description, versions before 10.0.1 implement an internal gate that is intended to restrict access to management-only endpoints. The flaw is that this gate performs its authorization decision based exclusively on HTTP request headers that are fully controlled by the client (the attacker).

Because the gateway trusts these headers without server-side validation, correlation to the authenticated session, or binding to the session's actual privilege set, an authenticated user with any valid REST session can manipulate the headers to make the request appear as though it originated from a trusted internal caller. The internal gate then permits the request to proceed into the restricted endpoint space.

Key characteristics of this vulnerability:

• Authentication vs. authorization gap: The attacker must already hold a valid REST session (authenticated), but the flaw lets a low-privilege session escalate its effective access to restricted read endpoints. This is an authorization logic defect, not an authentication bypass of the login mechanism.
• Header-based trust boundary failure: The control boundary is enforced with client-controllable input. This is the defining condition of CWE-290 (Authentication Bypass by Spoofing). Any security decision derived from an unauthenticated, client-modifiable header is inherently bypassable.
• Read-only exposure of sensitive internal data: The description states the impact is exposure of (1) sensitive chassis metadata, (2) hardware memory patrolling state, and (3) firmware integrity audit logs. These are diagnostic/inventory-grade data sets that reveal internal hardware layout, health monitoring behavior, and firmware integrity posture — valuable reconnaissance material for a follow-on attack.

No specific header names, endpoint paths, function names, or parameter identifiers are disclosed in the NVD description. The precise header(s) spoofed and the exact restricted endpoint paths are not provided and must not be assumed or fabricated. The attack mechanism is described at the vulnerability-class level: a client-controllable header is trusted by an internal authorization gate.

The CVSS vector assigned for analysis (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) reflects: network reachable (AV:N), low attack complexity (AC:L), requiring low privileges — a valid session (PR:L), no user interaction (UI:N), unchanged scope (S:U), high confidentiality impact (C:H), and no integrity (I:N) or availability (A:N) impact, consistent with the read-only nature of the exposed data.

Exploitation Scenarios

Note: No public PoC or exploit code is available for CVE-2026-87670. The following attack chain is inferred strictly from the vulnerability class (CWE-290, header-based authorization bypass) and the impact described in the NVD entry. No specific header names, endpoints, or parameters are asserted because none are disclosed.

1. Reconnaissance / target identification An attacker identifies a reachable Brocade Fabric OS REST API gateway on a switch or director running a version prior to 10.0.1. The gateway is typically reachable over the management network. The attacker obtains any valid REST credential — for example, a low-privilege account legitimately issued for limited monitoring, or a previously compromised session token. The attacker does not need administrative rights.

2. Triggering the flaw class The attacker establishes a valid REST session (authenticated) and sends a request to a restricted management endpoint rather than to a permitted low-privilege endpoint. Normally the internal gate would reject this request for a low-privilege session. The attacker adds or modifies one or more client-controlled HTTP headers that the gate uses as its sole authorization signal. Because the gate trusts the header value and does not validate it against the caller's real session privileges, the request is treated as authorized.

3. Payload / execution method (vulnerability-class level) At the class level, the "payload" is the spoofed header (or set of headers) attached to an otherwise valid REST request. The manipulation is a standard HTTP header injection/spoofing against the request, not buffer overflow or code injection. The attacker iterates over candidate header values until the internal gate is satisfied and the response returns restricted data. No crafted exploit binary is required; this is performable with a standard HTTP client.

4. Post-exploitation impact Once the gate is bypassed, the low-privilege attacker can read: sensitive chassis metadata (hardware inventory, layout, identifying information about the switch/director), hardware memory patrolling state (internal memory health-monitoring behavior), and firmware integrity audit logs. This is read-only access. The immediate impact is information disclosure that materially improves an adversary's understanding of the target fabric's hardware and firmware posture, enabling further targeted attacks (e.g., identifying firmware versions for known-vulnerable exploitation, mapping internal hardware for lateral movement). Confidence in this attack chain is moderate — it is a faithful derivation of the stated flaw class and documented impact, but no independent validation exists.

Impact Assessment

CVE-2026-87670 is a confidentiality-only authorization bypass. The affected component is the REST API gateway in Brocade Fabric OS before 10.0.1. Because exploitation requires only a valid low-privilege REST session and no user interaction, any environment where a low-privilege FOS account exists and the REST gateway is network-reachable is in scope.

CVSS subscores and their implications:

• AV:N (Network): The REST gateway is a network service; exploitation is remote over the management network.
• AC:L (Low): No special conditions, race windows, or complex preconditions are described beyond holding a session.
• PR:L (Low): Requires a valid REST session — the attacker is authenticated but need not be privileged. This is the headline risk: privilege escalation from low to elevated read access.
• UI:N (None): No victim interaction required.
• S:U (Unchanged): Impact stays within the API gateway/device security authority.
• C:H (High confidentiality): Chassis metadata, memory patrolling state, and firmware integrity audit logs are exposed — internal, security-relevant data.
• I:N / A:N: No integrity or availability impact is described; the flaw yields read access only.

Blast radius: Every Brocade Fabric OS deployment running a version prior to 10.0.1 that exposes the REST API gateway. In SAN environments, FOS switches and directors are high-value infrastructure; leaked chassis metadata and firmware integrity data aid targeted follow-on attacks against the fabric. The absence of integrity/availability impact keeps the direct blast radius contained to information disclosure, but the exposed data is a strong precursor for more damaging campaigns.

Exploit maturity: Low. EPSS is 0.00139 (2.8th percentile of exploited CVEs), no public PoC, no Nuclei template, no exploit code, and not listed in CISA KEV. The vulnerability is not currently under observed mass exploitation. Risk is nevertheless material for targeted actors because it requires only low privileges and yields high-value reconnaissance.

Detection Guidance

Sigma Rule

title: Brocade Fabric OS REST API Header-Based Authorization Bypass (CVE-2026-87670)
id: 8f3a1c2e-4b7d-4e91-9a2c-6d5e7f8a9b0c
status: experimental
description: Detects requests to Brocade Fabric OS REST API gateway where client-controlled headers are manipulated against restricted management endpoints, consistent with CWE-290 header spoofing.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-87670
author: valtersit.com
date: 2026/01/01
tags:
  - attack.t1078
  - attack.t1190
logsource:
  category: webserver
  product: brocade
detection:
  selection_uri:
    cs-uri-stem|contains:
      - '/rest/'
  selection_headers:
    # Client-controlled headers used as sole authorization signal against restricted endpoints.
    # Adjust header names to your environment's observed REST gateway headers.
    cs-headers|contains:
      - 'X-Forwarded'
      - 'X-Internal'
      - 'X-Original'
  selection_status:
    sc-status:
      - 200
      - 403
  condition: selection_uri and selection_headers and selection_status
fields:
  - c-ip
  - cs-uri-stem
  - cs-headers
  - sc-status
falsepositives:
  - Legitimate reverse proxy or load balancer adding forwarding headers
level: medium

YARA Rule

rule CVE_2026_87670_Brocade_FOS_REST_Header_Spoof_Indicators
{
    meta:
        description = "Detects Brocade Fabric OS REST API artifacts related to header-based authorization bypass (CVE-2026-87670, CWE-290)"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-87670"
        date = "2026-01-01"
        severity = "medium"

    strings:
        $fos1 = "Fabric OS" ascii nocase
        $fos2 = "fabric-os" ascii nocase
        $api1 = "/rest/" ascii nocase
        $api2 = "/rest/running" ascii nocase
        $meta1 = "memory patrolling" ascii nocase
        $meta2 = "firmware integrity" ascii nocase
        $hdr1 = "X-Internal" ascii nocase
        $hdr2 = "X-Original-" ascii nocase
        $hdr3 = "X-Forwarded-" ascii nocase

    condition:
        uint32(0) != 0x89504E47 and
        (
            (any of ($fos*)) and (any of ($api*))
            or
            (2 of ($meta*))
            or
            (any of ($hdr*) and any of ($api*))
        )
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-87670 Brocade Fabric OS REST API Header-Based Authorization Bypass Attempt"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"/rest/"; http.header; content:"X-Forwarded"|0D 0A| nocase; sid:8767001; rev:1; metadata:created_at 2026_01_01, cve CVE_2026-87670, mitre_tactic_id T1078; classtype:attempted-user; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-87670;)

alert http any any -> any any (msg:"CVE-2026-87670 Brocade Fabric OS REST API Header Spoof Internal"; flow:established,to_server; http.uri; content:"/rest/"; http.header; content:"X-Internal"|0D 0A| nocase; sid:8767002; rev:1; metadata:created_at 2026_01_01, cve CVE_2026-87670, mitre_tactic_id T1078; classtype:attempted-user; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-87670;)

Elastic Detection

sequence by source.ip, user.name with maxspan=30s
  [ network where network.protocol == "http" and
      url.path : "/rest/*" ]
  [ network where network.protocol == "http" and
      url.path : "/rest/*" and
      http.request.headers : ("X-Forwarded*", "X-Internal*", "X-Original*") ]

Splunk SPL Query

index=web sourcetype=brocade:rest OR sourcetype=access_combined
| eval host=coalesce(host, c_ip, src)
| eval uri=coalesce(cs_uri_stem, url, uri_path)
| eval usr=coalesce(user, cs_username, src_user)
| where match(uri, "(?i)/rest/")
| eval spoof_header=if(match(_raw, "(?i)X-(Forwarded|Internal|Original)[A-Za-z0-9-]*:"), "yes", "no")
| where spoof_header="yes"
| stats count min(_time) as first_seen max(_time) as last_seen
        values(uri) as endpoints values(sc_status) as statuses by host usr
| where count > 0
| convert ctime(first_seen) ctime(last_seen)
| sort - count

Wazuh OSSEC Rule

<group name="brocade,web,attack,">
  <rule id="876700" level="10">
    <decoded_as>web</decoded_as>
    <field name="url">/rest/</field>
    <regex type="pcre2">X-(Forwarded|Internal|Original)[A-Za-z0-9-]*:\s*</regex>
    <description>CVE-2026-87670: Possible Brocade Fabric OS REST API header-based authorization bypass (CWE-290) from $(srcip)</description>
    <mitre>
      <id>T1078</id>
      <id>T1190</id>
    </mitre>
    <group>cve_2026_87670,authorization_bypass,</group>
  </rule>

  <rule id="876701" level="12">
    <if_sid>876700</if_sid>
    <field name="status">200</field>
    <description>CVE-2026-87670: Brocade FOS restricted REST endpoint returned 200 after suspicious header manipulation - possible successful bypass</description>
    <group>cve_2026_87670,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 — UNPATCHED. No patch evidence is available from any tracked source, and the vendor has not published a fix reference in the provided data. Treat affected deployments as unpatched until a vendor fix is confirmed.

1) Immediate mitigations

• Restrict network access to the Brocade Fabric OS REST API gateway to trusted management subnets only; do not expose it to untrusted or broad internal networks.
• Enforce strict least privilege on FOS REST accounts. Because the flaw lets any valid low-privilege session reach restricted endpoints, eliminate unnecessary low-privilege REST accounts and disable the REST gateway on devices that do not require it.
• Deploy the detection rules above and monitor for requests to /rest/ endpoints that carry client-supplied forwarding/internal-type headers, which should be stripped or rejected at trust boundaries.
• Strip or reject inbound client-controllable headers (X-Forwarded-*, X-Internal*, X-Original*, and comparable) at any reverse proxy or load balancer in front of the gateway so client-supplied values cannot reach the FOS internal gate.

2) Patch / upgrade steps

• No patch is currently available per tracked sources. Monitor the vendor for a Brocade Fabric OS release at or above 10.0.1 and the associated security advisory; the NVD description names 10.0.1 as the version boundary. Apply the vendor fix as soon as it is released and validated.
• Until a fix exists, treat any Fabric OS version before 10.0.1 as vulnerable and apply the compensating controls above.

3) Long-term hardening

• Adopt a server-side authorization model: never base access decisions on client-controlled header values. Fixing this class requires validating authorization against the authenticated session's actual role and privilege set.
• Implement defense-in-depth for management-plane access: dedicated management VLANs, certificate-based mutual authentication, and session binding to privilege context.
• Maintain an inventory of Brocade FOS firmware versions and subscribe to vendor security advisories for rapid patch response.
• Continuously monitor firmware integrity audit logs and chassis metadata access for anomalous low-privilege reads, which may indicate exploitation of this or similar authorization bypasses.

References

• NVD — CVE-2026-87670: https://nvd.nist.gov/vuln/detail/CVE-2026-87670
• CWE-290 — Authentication Bypass by Spoofing: https://cwe.mitre.org/data/definitions/290.html
• MITRE ATT&CK T1078 — Valid Accounts: https://attack.mitre.org/techniques/T1078/
• MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
• Broadcom/Brocade Fabric OS Security Advisories (vendor advisory portal): https://www.broadcom.com/support/fibre-channel-networking/security-advisories

Threat actor / in-the-wild note: No threat actor campaigns or exploit-in-the-wild evidence are associated with CVE-2026-87670 in the provided data. CISA KEV listing: NO. EPSS 0.00139 (2.8th percentile), no public PoC, no Nuclei template, and no exploit code — indicating low current exploitation activity, while the vulnerability remains attractive for targeted reconnaissance due to its low-privilege prerequisite and high-value information disclosure.