CVE-2026-91768

Name of the Vulnerable Software and Affected Versions The product name cannot be determined (affected versions not specified)

Description The FastCGI client access check for IPv6 addresses incorrectly compares only the first 12 bytes of a 16-byte address. This causes the listen.allowed clients check to match based on a /96 prefix rather than the exact address. An attacker using an address that shares the first 96 bits with an authorized address can bypass the access control and reach the FastCGI endpoint.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.