NGINX DAV: Pre-Auth RCE Discovered by Calif.io in Collaboration with

A vulnerability in the NGINX HTTP DAV module allows unauthenticated remote code execution. The ZDI-26-578 advisory, published August 13, 2026 by Trend Micro's Zero Day Initiative, documents the flaw assigned CVE-2026-27654. The discovery is credited to Calif.io in collaboration with Claude and Anthropic Research, with coordinated disclosure initiated March 6, 2026. Sources do not specify the exact role of Claude nor document historical precedents; it cannot be determined whether this represents an absolute first in the field. Specific affected NGINX versions are not known; a patch is not confirmed in primary sources.

The Mechanism: How an Alias in a Prefix Location Becomes an Attack Vector

The vulnerability lies in the parsing of WebDAV requests when the NGINX configuration employs three elements in combination: the ngx_http_dav_module, a prefix-type location (not a regular expression), and the alias directive. The ZDI advisory describes the flaw as a consequence of "lack of proper validation of user-supplied data, which can result in an integer underflow prior to writing to memory."

The CVE-2026-27654 record specifies that the condition triggers with the WebDAV protocol's MOVE or COPY methods. The calculation of sizes or offsets for path handling fails in an integer underflow. The result is an out-of-bounds write in the worker process context.

The distinction between "prefix location" and "regex location" is technical but relevant: the former uses simple prefix matching, the latter regular expressions. The bug does not affect configurations with location ~ or equivalent regex. Many deployments using WebDAV for file sharing employ prefix locations with alias to map virtual paths to physical directories.

"This vulnerability allows remote attackers to execute arbitrary code on affected installations of NGINX. Authentication is not required to exploit this vulnerability." — ZDI Advisory ZDI-26-578

From Underflow to Buffer Overflow: The Technical Chain

The ZDI advisory explicitly describes an integer underflow. The CVE record uses the formulation "buffer overflow." The two descriptions likely indicate the same causal chain: the integer underflow in the calculation as the root cause, the buffer overflow as the consequence on memory.

The CVSS 3.1 published on CVE.org — vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H — classifies the attack as remote, low complexity, without privileges or user interaction. Scope is unchanged: the exploit remains confined to the NGINX worker process. The lack of confidentiality impact and integrity limited to "Low" reflect the execution context restrictions.

CVSS 4.0 raises the score to 8.8 while maintaining HIGH severity. The discrepancy between scoring framework versions does not alter the operational assessment: the vulnerability is critical for service availability, less so for data compromise.

Attribution and Source Limitations

The CVE record states: "F5 acknowledges Calif.io in collaboration with Claude and Anthropic Research for bringing this issue to our attention and following the highest standards of coordinated disclosure." The formulation "in collaboration with" indicates joint participation, not autonomous AI discovery.

The ZDI advisory provides the flaw mechanism; the CVE record supplements with CVSS and technical conditions. Neither source offers exploit details or exposure metrics. The brief does not document interpretability techniques or human verification methodology. On this point, the dossier presents an informational gap.

Recommended Actions

• Verify whether your NGINX configurations enable the ngx_http_dav_module with the alias directive in a prefix location: this specific combination is the necessary condition documented by sources
• Check for the presence of MOVE and COPY methods in active WebDAV configurations
• Monitor official F5/NGINX channels for updates on affected versions and patches: sources do not indicate specific versions nor confirm fix availability
• Evaluate access restrictions on exposed WebDAV interfaces, pending vendor clarification
• Review logs for anomalous requests on WebDAV endpoints with MOVE/COPY patterns

Context and Informational Limits

Coordinated disclosure began March 6, 2026; public release occurred August 13, 2026. This roughly five-month interval falls within standard ZDI program timelines. Sources do not provide data on similar prior collaborations between research teams and language models in vulnerability research.

The CVE record notes that "Software versions which have reached End of Technical Support are not evaluated." This note does not clarify which supported versions are affected. The ZDI advisory does not list specific versions in the available text.

The documented alternate impact includes worker process termination or modification of source/destination filenames outside the document root. These conditions occur in the same vulnerable configuration context.

Closing

CVE-2026-27654 is a HIGH-severity vulnerability in the NGINX HTTP DAV module, exploitable without authentication in configurations with alias and prefix location. The discovery by Calif.io in collaboration with Claude and Anthropic Research is formally acknowledged in the CVE record. Primary sources — the ZDI advisory and CVE record — provide the flaw mechanism and technical conditions, but do not document affected versions, available patches, or exploit details. Risk assessment requires direct verification of exposed NGINX configurations.