Nginx Plus CVE-2026-28755

The CVSS 5.4 (Medium) score with vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N indicates network-accessible attack surface with low attack complexity but requiring authenticated privilege level, resulting in localized confidentiality and integrity impact without availability impact. The requirement for PR:L (authenticated attacker) significantly limits real-world exploitation compared to unauthenticated scenarios. However, the vulnerability directly contradicts the security posture that organizations implementing certificate pinning and OCSP checking expect—making it a priority for environments enforcing mutual TLS or client certificate authentication. The authentication requirement and medium CVSS score suggest this is not a critical infrastructure emergency but requires timely patching for security-conscious deployments relying on certificate-based access controls.

An attacker with a valid client certificate (e.g., obtained through credential compromise or insider access) submits the certificate during TLS handshake to an NGINX endpoint configured with ssl_verify_client and ssl_ocsp enabled. Although the certificate has been revoked and the OCSP responder correctly identifies it as such, the vulnerable ngx_stream_ssl_module fails to deny the connection, allowing the attacker to establish an authenticated session despite the revocation status. This is particularly dangerous in zero-trust architectures where certificate revocation serves as the primary access control mechanism for service-to-service communication.