CVE-2026-87670: CWE-290: Authentication Bypass by Spoofing in Brocade Fabric OS

This vulnerability in Brocade Fabric OS versions prior to 10.0.1 affects the REST API gateway's authorization logic. The internal gate that restricts access to management endpoints depends exclusively on HTTP headers controlled by the client. Consequently, any authenticated user with a valid REST session can spoof these headers to bypass authorization controls and gain unauthorized access to sensitive internal management endpoints. The exposed information includes chassis metadata, hardware memory patrolling state, and firmware integrity audit logs. The CVSS 4.0 base score is 5.1, indicating a medium severity level. No known exploits are reported in the wild, and no vendor patch links are provided in the data.

Low-privilege authenticated users can bypass authorization controls to access sensitive internal management endpoints. This exposure allows viewing of chassis metadata, hardware memory patrolling state, and firmware integrity audit logs, potentially aiding further reconnaissance or attacks. The vulnerability does not allow privilege escalation beyond the authenticated session or remote unauthenticated access according to the provided data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or fix is referenced, users should monitor vendor communications for updates. Until a fix is available, restrict REST API access to trusted users and networks to minimize risk.