CVE-2026-1642 (nginx SSL Upstream Injection) Reported on vCenter Server

Products

• VMware vCenter Server

Issue/Introduction

A vulnerability scan reports CVE-2026-1642 against vCenter Server and identifies the bundled nginx version as vulnerable.

Example:

• Installed nginx version: 1.26.3
• Fixed version reported by scanner: 1.28.2 or later
• CVE: CVE-2026-1642 (nginx SSL Upstream Injection)

Environment

VMware vCenter Server

Cause

CVE-2026-1642 affects nginx deployments that are configured to proxy requests to upstream servers over TLS using directives such as:

proxy_pass https://...

The vulnerability is only applicable when the affected nginx code path is exercised through upstream TLS proxy functionality.

 

Resolution

CVE-2026-1642 is not applicable to the vCenter Server configuration.

CVE-2026-1642 requires nginx to be configured to proxy requests to upstream servers over TLS using directives such as proxy_pass https://. The nginx instance bundled with vCenter does not proxy requests to upstream servers and is configured only to serve static content and health-check responses. As the vulnerable code path is not utilized in the current configuration, the vulnerability is not exploitable in vCenter as deployed, despite the scanner identifying the nginx version.