PHP-FPM: Bypassing FastCGI Access Restrictions via IPv6

A vulnerability has been discovered in PHP CVE-2026-91768, involving improper IP address validation in the listen.allowed_clients mechanism. This PHP-FPM setting restricts the list of clients allowed to connect to FastCGI. Due to an error in IPv6 processing, the program compared only the first 96 bits instead of the full 128-bit address.

An attacker must be on a network from which the FastCGI endpoint is accessible and use an IPv6 address whose first 96 bits match those of an allowed client. Because the comparison is incomplete, the check allows such a connection even though the full address does not match the allowed address. The attacker can bypass the network restriction and access FastCGI without the required authorization. If the interface is accessible from a compromised or adjacent network segment, this could enable unauthorized interaction with PHP-FPM and the disclosure of confidential data.

Article: https://daubois.dev/blog/cve-2026-91768-php-fpm-ipv6-allowed-clients-bypass/