{"id":"CVE-2026-84731","published":"2026-10-15T18:17:29.960","lastModified":"2026-10-16T19:55:59.740","description":"An unauthenticated remote attacker can bypass authentication and gain full access to administrative API endpoints in Nutanix Prism Element by including a crafted internal management HTTP header. The vulnerability is caused by a misconfiguration in the application's authentication filters.\n\n\n\nConsequently, the server responds with a Set-Cookie header containing a valid JSESSIONID. This session cookie decodes to a JSON Web Token (JWT) granting maximum cluster administrative privileges. Successful exploitation allows the attacker to execute root-level commands on all Controller VMs (CVMs) in the cluster, leading to complete cluster destruction and unauthorized access to VM memory and virtual disks.","cvssScore":9.8,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-290","CWE-302","CWE-306"],"vendors":[],"products":[],"references":[{"url":"https://download.nutanix.com/alerts/Security_Advisory_0058.pdf","tags":[]},{"url":"https://portal.nutanix.com/page/documents/list?type=software&filterKey=software&filterVal=AOS","tags":[]},{"url":"https://www.nutanix.com/support","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"A critical authentication bypass vulnerability in Nutanix Prism Element allows unauthenticated attackers to gain full administrative access by exploiting a misconfigured authentication filter that accepts crafted internal management headers. This flaw enables attackers to execute root-level commands on all Controller VMs and access sensitive cluster data.","exploitability":"The vulnerability is highly exploitable with no prerequisites, requiring only network access to the affected API endpoints to craft and include a specific internal management HTTP header.","blast_radius":"If exploited, this vulnerability could lead to complete cluster destruction, unauthorized access to VM memory and virtual disks, and full administrative control over all cluster resources.","remediation":"No fixed version is published in the description.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["auth-bypass","api","cluster","admin-access"],"model":"garnet-coder","analyzedAt":"2026-10-16T08:46:07.292Z"}}