Detections
Analytics

Echo: nginx: security update to 1.26.3-3+deb13u10

high Tenable Cloud Security Plugin ID 477057

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - Description When NGINX Plus or NGINX Open Source is configured with ssl_session_cache shared:name:size
 without an explicit ssl_session_ticket_key file directives to automatically rotate SSL session ticket
 keys, a remote unauthenticated attacker is able to forge client SSL sessions in a non-deterministic manner
 that is beyond the attacker's control. An attacker could leverage this vulnerability to bypass
 verification of client certificates. Impact This vulnerability can lead to the exposure of resources or
 functionality to unintended actors, possibly providing attackers with access to sensitive information.
 There is no control plane exposure; this is a data plane issue only. Note: Software versions which have
 reached End of Technical Support (EoTS) are not evaluated. (CVE-2026-97629)

Solution

Update the nginx library and its related packages to version 1.26.3-3+deb13u10 or later.

See Also

https://advisory.echohq.com/cve/CVE-2026-97629

Plugin Details

Severity: High

ID: 477057

Version: Revision 1.1

Type: Local

Published: 10/23/2026

Updated: 10/23/2026

Risk Information

VPR

Risk Factor: Medium

Score: 6.5

Percentile: 96.27

CVSS v2

Risk Factor: Medium

Base Score: 6.1

Temporal Score: 4.8

Vector: CVSS2#AV:N/AC:H/Au:N/C:C/I:P/A:N

CVSS Score Source: CVE-2026-97629

CVSS v3

Risk Factor: Medium

Base Score: 6.5

Temporal Score: 5.9

Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

CVSS v4

Risk Factor: High

Base Score: 8.3

Threat Score: 6.9

Threat Vector: CVSS:4.0/E:P

Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

Vulnerability Information

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 10/15/2026

Vulnerability Publication Date: 10/14/2026

Reference Information

CVE: CVE-2026-97629

IAVA: 2026-A-1142