-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

HPE Aruba Networking Product Security Advisory
=======================================
Advisory ID: HPESBNW05119
CVE: CVE-2026-54763, CVE-2026-33377
Publication Date: 2026-AUG-07
Status: FINAL
Last Updated: 2026-AUG-07
Severity: CRITICAL
Revision: 1


Title
======
Multiple Vulnerabilities in HPE Aruba Networking Private 5G Core


Summary
=========
HPE Aruba Networking has released a patch for HPE Aruba Networking 
Private 5G Core to address multiple security vulnerabilities in third-party 
components (Traefik and Grafana). These vulnerabilities could allow for 
authentication bypass or privilege escalation.


Affected Products
================
HPE Aruba Networking Private 5G Core version 1.26.1.2 and below


Unaffected Products
=================
HPE Aruba Networking Private 5G Core version 1.26.1.3 and above are not 
affected by these vulnerabilities.


Details
=======

Traefik Authentication Middleware Header Handling Vulnerability 
(CVE-2026-54763)
- ------------------------------------------------------------------------
Traefik is an HTTP reverse proxy and load balancer. Prior to v2.11.51, 
v3.6.22, and v3.7.6, Traefik's BasicAuth, DigestAuth, and ForwardAuth 
middlewares strip canonical-cased spoofed identity headers before writing 
Traefik's own value, but do not account for underscore-variant header 
names, which many backends normalize identically to dashed forms. An 
attacker able to reach a protected route can inject an underscore-variant 
header that survives Traefik's stripping and reaches the backend 
alongside, or on the unauthenticated ForwardAuth authResponseHeaders 
path instead of, the value Traefik intended to set, spoofing identity or 
authorization context.

Internal Reference: VULN-715
Severity: Critical
CVSS v3.1 Base Score: 10.0
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N

Acknowledgements: This vulnerability was discovered by matte1782.


Grafana Dashboard Privilege Escalation Vulnerability 
(CVE-2026-33377)
- -------------------------------------------------------------------------
An authenticated Grafana Editor with write access could escalate to admin 
on a single dashboard. Grafana is internal and gated by Traefik JWT auth, 
limiting exposure to trusted operators.

Internal Reference: VULN-716
Severity: High
CVSS v3.1 Base Score: 7.1
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N

Acknowledgements: This vulnerability was discovered by Grafana Labs.


Resolution
==========
HPE Aruba Networking recommends upgrading HPE Aruba Networking 
Private 5G Core to version 1.26.1.3 or later. Software can be 
downloaded from the HPE Networking Support portal: 
https://myenterpriselicense.hpe.com/cwp-ui/software.


Workaround
===========
To minimize the likelihood of an attacker exploiting this vulnerability, 
HPE Aruba Networking recommends that management interfaces be restricted 
to a dedicated layer 2 segment/VLAN and/or controlled by firewall policies 
at layer 3 and above, along with accounting controls for tracking and 
logging user activities and resource usage. You may contact HPE Services, 
HPE Aruba Networking for assistance if needed. For more information, 
please visit HPE Networking Support Portal at: 
https://networkingsupport.hpe.com/home


Exploitation and Public Discussion
==========================
HPE Aruba Networking is aware of public discussion of CVE-2026-54763 
and CVE-2026-33377. However, HPE Aruba Networking is not aware of 
any exploit code targeting these vulnerabilities in HPE Aruba Networking 
Private 5G Core at the time of this advisory.


Revision History
==============
Revision 1 / 2026-AUG-07 / Initial release


HPE Aruba Networking SIRT Security Procedures
==============================================
Complete information on reporting security vulnerabilities in HPE Aruba 
Networking products and obtaining assistance with security incidents is 
available at: http://www.hpe.com/support/security-response-policy
for reporting NEW HPE Aruba Networking security issues, email can be 
sent to aruba-sirt@hpe.com. For sensitive information we encourage 
the use of PGP encryption. Our public keys can be found at: 
https://www.hpe.com/info/psrt-pgp-key

(c) Copyright 2026 by Hewlett Packard Enterprise Development LP. This 
advisory may be redistributed freely after the release date given at 
the top of the text, provided that the redistributed copies are complete 
and unmodified, including all data and version information.

-----BEGIN PGP SIGNATURE-----

iQHLBAEBCAA1FiEEQT1cq06WWXH+NEKru7x8adyj7A4FAmpzO40XHHNlY3VyaXR5
LWFsZXJ0QGhwZS5jb20ACgkQu7x8adyj7A73eAwAjGlnjqVylhtFUbdlV+7lrswk
9lFVF67EpIujWF2D01DcGPn9idaEBLhSOr7UkB4TRMWTf+yOgwhzBjMcu6ZYFEw8
6Lq/a0riw+Janz7tOiu6HKhJruh9WS6Bf5jU7Tkm17twaP4Vt4MRzcPgfm43igIC
NC0+bm81P9YW3AEYQ6yRd5D4/cAugCrX+jpNGbNFPxIyCX73FD6O1xDcoxqSQonk
JHPPkMZkPOX/S/G+3d1kjBimKrZAu4xmLAUur2yGDLYuK9m3ZttokVXRXh6g2Ucz
BPj2YgLc3lkaNXPV5OWiO4o/fnByCpGp9oEok2Wre3/9+APdzms3fG9EhCqoSDax
Wh3get9ma8ih0wXu5hVNRb0zB1+8sdUgjxVDUJ7kbVg0l0AYHuTkk/nOct6pMyBm
D3OfQErVUYZkgSybeRR5KGoGz0568lUT2apdW8Tc6fXBBlJfYa+eYNbhxMbIQGYN
0NsK0kdO/C/eO0xsl7/dLIuteC6Lh/tBy5o92EFz
=EhXo
-----END PGP SIGNATURE-----