HPE Networking Fabric Composer: unauthenticated SQL injection from an adjacent network

Impact

Fabric Composer is the management plane for HPE datacenter switch fabrics. An unauthenticated attacker on an adjacent network can run arbitrary database commands against it, which puts the fabric controller's own state - credentials, topology, policy - at risk and with it the configuration of the switches it drives. In a GPU datacenter the switch fabric carries tenant and storage traffic, so control over the fabric manager is a cross-tenant position rather than a single-host problem. The record rates confidentiality, integrity and availability all high; attack complexity is high.

Who can reach it

Anyone with access to the management network adjacent to Fabric Composer. No authentication required.

What to do

Apply the fixed Fabric Composer release named in the HPE bulletin (hpesbnw05172en_us) and keep the appliance on an isolated management VLAN reachable only from jump hosts. Updating is a management-appliance upgrade and restart; switch data plane traffic is not interrupted.

References

Related entries

• Linux mlxsw: PTP garbage collector calls napi_gro_receive outside NAPI context, corrupting the GRO listCVE-2026-98050 · Linux kernel mlxsw spectrum_ptp (PTP garbage collector calling napi_gro_receive)High
• RoCEv2 lossless Ethernet fabric - IEEE 802.1Qbb Priority Flow Control: RoCE requires a lossless network, which inNCVD-2018-001-rocev2-lossless-ethernet-fabric · RoCEv2 lossless Ethernet fabric - IEEE 802.1Qbb Priority Flow ControlHigh
• RoCEv2 lossless Ethernet fabric - IEEE 802.1Qbb Priority Flow Control: RoCE requires a lossless network, which inNCVD-2018-006-rocev2-lossless-ethernet-fabric · RoCEv2 lossless Ethernet fabric - IEEE 802.1Qbb Priority Flow ControlHigh
• InfiniBand/RoCE Communication Manager (CM) and RNIC connection-state resources: RNICs hold per-connection state in aNCVD-2021-005-infiniband-roce-communication-ma · InfiniBand/RoCE Communication Manager (CM) and RNIC connection-state resourcesHigh
• InfiniBand/RoCE Communication Manager (CM) and RNIC connection-state resources: RNICs hold per-connection state in aNCVD-2021-011-infiniband-roce-communication-ma · InfiniBand/RoCE Communication Manager (CM) and RNIC connection-state resourcesHigh
• OpenBMC bmcweb HTTP/1.1 Expect: 100-continue handling: bmcweb applies a 4 KB body limit to unauthenticated requestsNCVD-2026-001-openbmc-bmcweb-http-1-1-expect-1 · OpenBMC bmcweb HTTP/1.1 Expect: 100-continue handlingHigh