PHP-FPM Vulnerability CVE-2026-91768 Allows IPv6 Access Control Bypass
A flaw in the PHP-FPM FastCGI implementation causes incorrect IPv6 address validation, allowing attackers to bypass access control lists configured via the allowed_clients directive.
CVE-2026-91768 is a security vulnerability in the PHP-FPM FastCGI implementation. The flaw involves incorrect IPv6 address validation.
When you configure the allowed_clients directive to restrict access to the FastCGI interface, the verification mechanism checks only the first 96 bits of an IPv6 address rather than the full 128 bits. This leaves a 32-bit gap. An attacker can exploit this by crafting an IPv6 address that matches the initial 96 bits of a permitted address. If accepted, unauthorized clients can connect past the intended configuration limits.
Access control lists using IPv6 addresses for PHP-FPM endpoints are currently unreliable. Systems using allowed_clients for network source restriction are susceptible to this bypass.
Administrators should review their network security settings. Maintainers need to enforce security policies at the firewall level or via secondary network isolation methods, because relying solely on the affected directive for IPv6 traffic may be insufficient.