Nutanix Prism Gateway Authentication Bypass Enables Cluster-Administrative Access

An unauthenticated remote attacker can bypass authentication and gain full access to administrative API endpoints in Nutanix Prism Element by including a crafted internal management HTTP header. The vulnerability is caused by a misconfiguration in the application's authentication filters. Consequently, the server responds with a Set-Cookie header containing a valid JSESSIONID. This session cookie decodes to a JSON Web Token (JWT) granting maximum cluster administrative privileges. Successful exploitation allows the attacker to execute root-level commands on all Controller VMs (CVMs) in the cluster, leading to complete cluster destruction and unauthorized access to VM memory and virtual disks.

• Nutanix AOS / Prism Element, Prism Gateway component: affected from 0 through versions less than 7.3.1.18, from 7.5 through versions less than 7.5.2, and from 7.6 through versions less than 7.6.0.8. The structured affected data identifies 7.3.1.18, 7.5.2, and 7.6.0.8 as unaffected change points.
• Nutanix Prism Central: the Nutanix advisory also lists this product with corresponding fix releases 7.3.1.18, 7.5.2, and 7.6.0.8. The structured CVE affected data does not enumerate Prism Central as a separate product, so its branch status is supported by the advisory rather than by a separate structured range in the supplied record.
• The affected data has a default status of unaffected outside the listed ranges. Do not infer that an unlisted parallel branch is safe without checking the applicable advisory and release notes.

The flaw is in the authentication handling of Prism Gateway in Prism Element. An unauthenticated remote attacker with network access to the management interface can send an HTTP request containing a crafted internal management header to the API. Because of a misconfiguration in the application's authentication filters, the server returns a Set-Cookie header containing a valid JSESSIONID; that cookie decodes to a JSON Web Token with maximum cluster-administrative privileges.

The documented high-level flow is:

1. The attacker sends a request to the Prism management interface with a specially crafted internal header.
2. The authentication filters process the header incorrectly and bypass the normal authentication requirement.
3. The server issues a JSESSIONID session cookie with the highest administrative privileges.
4. Those privileges provide access to administrative APIs and can lead to root-level command execution on the cluster's Controller VMs (CVMs).

Nutanix identifies the relevant management interface as using port 9440. The public record does not disclose the exact header value or the implementation details of the authentication filters, so the header string and deployment-specific behavior should not be inferred.

The vulnerability is remotely reachable through the Prism management interface and does not require valid credentials or user interaction. The attacker must be able to connect to the management interface, particularly port 9440; practical exposure depends on whether that interface is reachable from networks outside trusted administrative access.

The CNA record states that proof-of-concept exploitation was validated during responsible disclosure. It does not establish that an active exploitation campaign is occurring. No public exploit code or automated attack toolkit is currently identified as publicly distributed in the consulted record.

Successful exploitation can grant an unauthenticated attacker access to administrative APIs with maximum cluster-administrative privileges. The documented technical outcome includes root-level command execution on CVMs, impact across the cluster, and unauthorized access to VM memory and virtual disks.

Potential consequences include loss of data confidentiality, unauthorized changes to configuration or workloads, and loss of availability through cluster destruction. The scope is infrastructure-wide, but exploitation still depends on network reachability to the Prism management interface and the resources hosted by the cluster. The record does not establish that every deployment has been compromised or that data loss has occurred.

The vulnerability can turn an exposed management interface into an unauthenticated control point for the cluster. The resulting privileges may allow changes to or destruction of cluster resources, interrupt virtual-machine services, and compromise the integrity of the infrastructure.

Because the documented impact includes root-level command execution on CVMs, a successful attack could cause complete cluster destruction. Unauthorized access to VM memory and virtual disks could also expose workload data or compromise the confidentiality of hosted systems. Actual damage depends on network reachability and the data and workloads present in the cluster.

1. Upgrade affected AOS deployments to the exact fixed release for the branch in use: 7.3.1.18, 7.5.2, or 7.6.0.8. Do not treat these fixes as an open-ended range covering every other release branch without explicit confirmation.
2. For Prism Central, reconcile the Nutanix advisory and release notes, then deploy the corresponding fixed release for the branch in use.
3. Before patching is complete, restrict Prism management access to trusted administrative networks, jump boxes, or authorized IP ranges. Nutanix identifies this as a defense-in-depth mitigation.
4. Do not rely solely on filtering the internal management header at a WAF or reverse proxy unless Nutanix has validated compatibility. If patching cannot be completed immediately, contact Nutanix Support for validated temporary guidance rather than guessing or implementing an unverified header string.
5. After upgrading or restricting access, review audit data for unauthorized administrative activity and preserve evidence for investigation if suspicious behavior is found.

Perform the following checks:

• Inventory Nutanix AOS and Prism Central deployments and identify systems running release branches within the affected scope.
• Review firewall rules, ACLs, load balancers, and network paths to determine whether the Prism management interface, particularly port 9440, is reachable from networks not restricted to trusted administrators.
• Review Prism audit data and administrative activity for unauthorized administrative API actions, and preserve relevant data if compromise is suspected.
• If unauthorized administrative activity is suspected, restrict access to the management interface and contact Nutanix Support.

The available sources do not define a specific IOC or log signature. The absence of suspicious evidence in currently available logs does not prove that a system is safe.