CVE-2026-97629

A flaw was found in nginx. Under specific configurations where shared SSL session caching is enabled without explicit session ticket key rotation, a remote unauthenticated attacker may be able to forge client Secure Sockets Layer (SSL) sessions. This flaw allows an attacker to bypass client certificate verification and gain unauthorized access to protected resources and sensitive information.

A flaw was found in NGINX core SSL session handling. When configured with shared SSL session caching (ssl_session_cache shared:...) without explicit session ticket key rotation directives (ssl_session_ticket_key), automatic ticket key management allows client SSL session forgery in a non-deterministic manner. A remote unauthenticated attacker can exploit this condition to forge session tickets, bypassing client certificate verification (mTLS) to gain unauthorized access to protected upstream resources. Default SELinux policies and unprivileged worker confinement prevent process escape, restricting exposure entirely to the TLS termination layer.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Disable TLS session tickets by specifying ssl_session_tickets off; within the server or http configuration blocks. Alternatively, configure the ssl_session_ticket_key directive to point to a managed key file and rotate the secret out-of-band.