Monitor vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.8

Nginx: Shared IP Port Allows Bypass of Client Certificate Checks

CLEANSTART-2026-ZN32454
Summary

If multiple Nginx servers share the same IP and port, an attacker can bypass security checks that require client certificates. This could allow unauthorized access to sensitive information. Update your Nginx configuration to ensure each server has a unique IP and port, or apply the recommended patches to prevent this issue.

What to do
  • Update nginx to version 1.26.3-r0.
Affected software
VendorProductAffected versionsFix available
– nginx <= 1.26.3-r0 1.26.3-r0
Original title
When multiple server blocks are configured to share the same IP address and port, an attacker can use session resumption to bypass client certificate authentication requirements on these servers
Original description
Multiple security vulnerabilities affect the nginx package. When multiple server blocks are configured to share the same IP address and port, an attacker can use session resumption to bypass client certificate authentication requirements on these servers. See references for individual vulnerability details.
osv CVSS3.1 9.8
Published: 27 Feb 2026 · Updated: 13 Mar 2026 · First seen: 9 Mar 2026