Cisco Nexus Dashboard Fabric Controller (REST API / web UI): A low-privileged NDFC user

Impact

A low-privileged NDFC user — the sort of read-mostly account you hand to an NOC or a tenant liaison — gets command injection on the fabric controller. NDFC holds the credentials for and pushes config to every switch it manages, so this is a straight path from a minor account to control of the whole leaf/spine build.

Who can reach it

Authenticated but low-privileged, remote. Any valid NDFC login is enough.

What to do

Upgrade NDFC. Controller-side software upgrade, data plane unaffected. Afterwards rotate the device credentials NDFC stores, because those are what an attacker would have taken.

References

Related entries

• Zabbix: SQL injection in CUser::addRelatedObjects reachable by ANY non-admin account with API accessCVE-2024-42327 · ZabbixCritical
• Grafana: SQL Expressions passes user input to duckdb unsanitizedCVE-2024-9264 · GrafanaCritical
• Redis: "RediShell" - authenticated user crafts a Lua script to trigger a use-after-freeCVE-2025-49844 · RedisCritical
• Logging operator: unescaped Flow CRD values inject Fluentd directives and run commands in the aggregatorCVE-2026-54680 · Logging operator (Fluentd config renderer, pkg/sdk/logging/model/render/fluent.go)Critical
• Prowler: legacy gcp auth-provider in kubeconfig runs commands on the shared scan workerCVE-2026-73263 · Prowler API (Kubernetes provider connection test, kubeconfig exec-auth validation)Critical
• Ansible automation-controller: copied workflows keep instance groups, letting a tenant run jobs on the control planeCVE-2026-84719 · Red Hat Ansible Automation Platform automation-controller (workflow deep-copy permission sanitizer)Critical