External risk intelligence

Nutanix Prism Element Authentication Bypass via Crafted HTTP Header.

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-84731

Nutanix Prism Element serves as a centralized management interface for clusters. While these interfaces are intended for administrative use and typically reside within internal networks, they are frequently exposed to management subnets or via VPN/gateways, making them a common target for administrative access and a well-known service in enterprise IT deployments.

Missing Authentication

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical security vulnerability exists in Nutanix Prism Element, allowing unauthenticated attackers to bypass authentication and gain full administrative control over clusters. This could enable them to execute commands, destroy the cluster, and access sensitive data. The main concern is confirming relevance and exposure to Nutanix environments.

Unauthenticated access to cluster administration.
High-impact compromise of critical infrastructure.
Assess relevance and exposure immediately.

Attack Path

How an attacker could exploit the issue

An unauthenticated attacker can compromise Nutanix Prism Element by sending a specially crafted HTTP header. This header bypasses authentication and grants the attacker full administrative access to API endpoints. The server then issues a session cookie containing a JSON Web Token (JWT) that allows the attacker to execute commands with root privileges on Controller VMs, potentially leading to complete cluster destruction and data access.

No authentication required.
Crafted HTTP header bypasses controls.
Full administrative access and command execution.

Live Threat

Current exploitation, exposure, and threat context

An unauthenticated attacker could bypass authentication to gain full administrative access to Nutanix Prism Element's API endpoints. This is possible by sending a specially crafted HTTP header, which leads to a session cookie that grants maximum cluster administrative privileges. When this vulnerability is exploited, an attacker could execute root-level commands on Controller VMs, potentially leading to cluster destruction and unauthorized access to VM data.

Administrative API access at risk.
Via crafted HTTP header and session cookie.
Complete cluster destruction and data access.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability impacts Nutanix Prism Element, the administrative interface for Nutanix clusters. Responsibility for addressing this issue likely falls to the infrastructure or platform teams managing the Nutanix environment, in coordination with the security team. The first practical step is to identify all instances of Prism Element, confirm their network exposure and business criticality, and then determine the accountable owner for remediation planning.

Own the issue: Infrastructure/Platform Teams.
Verify first: Network exposure and criticality.
Action: Plan targeted remediation.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Nutanix Prism Element?

Nutanix Prism Element is the centralized management interface used to configure and monitor Nutanix clusters. It acts as the command center for infrastructure administrators to manage virtual machines, storage, and networking resources across their environment. Because it serves as a critical management point, it handles authentication for high-level administrative tasks and interacts directly with Controller VMs (CVMs) that govern cluster operations.

What weakness allows this CVE-2026-84731 authentication bypass?

This vulnerability is an authentication bypass, specifically categorized under CWE-290, CWE-302, and CWE-306. It stems from a misconfiguration in how the software handles authentication filters. An attacker can trick the system by providing a specially crafted HTTP header, causing the server to incorrectly issue a valid session cookie. This cookie contains a JSON Web Token (JWT) that erroneously grants the user maximum administrative privileges without requiring a valid login.

How does an attacker trigger this vulnerability?

An attacker triggers this by sending a specifically formatted HTTP header to the administrative API endpoints of Prism Element. Because the issue exists in the authentication filtering logic itself, no legitimate credentials or prior access are needed to initiate the request. The vulnerability is triggered solely by the inclusion of this crafted header; standard, non-malicious HTTP traffic does not trigger the bug.

Is my Nutanix Prism Element instance at risk?

According to Halo Surface Signal, risk depends on how your management interface is deployed. While these interfaces are designed for internal networks, they are frequently reachable through management subnets, VPNs, or gateways. If your Prism Element interface is accessible beyond your secure management perimeter, it is more likely to be targeted by an attacker attempting to exploit this administrative bypass.

What is the first step to address this issue?

Your initial priority is to identify all deployed instances of Prism Element within your environment. Infrastructure and platform teams should collaborate to verify which interfaces are accessible over the network and assess their business criticality. Once your inventory is clear, confirm who owns each instance and prioritize them for remediation according to your organization's security patching and maintenance procedures.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.