Is This A Joke? In The Auth Header? (F5 BIG-IP UnAuth Heap-Overflow to RCE CVE-2026-94127)

What it is

CVE-2026-94127 is an unauthenticated heap overflow in the BIG-IP traffic management process (tmm), in the APM OAuth userinfo handler. F5 advisory K000162605 covers it. watchTowr writes that attackers are already exploiting it. The advisory's affected-version list did not survive in the fetched text, so check K000162605 for the exact ranges.

How it works

The handler allocates a 0x4100-byte (16,640-byte) heap buffer with umalloc, then copies the Authorization header into it. Before the fix, it never compared the header length to 0x4100. The patched code rejects longer headers with the error "Authorization header too big."

watchTowr's lab crash came from one request with a Bearer value longer than 0x4100 bytes:

GET /f5-oauth2/v1/userinfo HTTP/1.1
Host: bigip
Authorization: Bearer AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA...
Connection: close

The crash was a tmm_assert inside ufree on corrupted heap metadata. In about 90% of watchTowr's runs, an object holding a callback function pointer sat at buffer + 0x4ff8. Overwriting it gave control of a call through that pointer.

Exploit hardening on the target: system-wide ASLR, canary, NX, no executable heap or stack, and no PIE (base 0x400000). The lack of PIE is what allows a ret2plt chain.

SELinux blocked the obvious payload. An execvp call returned EACCES, and the web server was also confined, so a dropped web shell was not an option. watchTowr instead used open and write to append a command to /etc/bigstart/scripts/tmm.finish, a script that runs each time tmm crashes. The proof of concept wrote touch /watchTowr.txt.

Preconditions / Affected

• The target needs a virtual server with an APM OAuth profile configured. watchTowr built its lab this way.
• The endpoint is reachable without authentication. watchTowr used /f5-oauth2/v1/userinfo and says any OAuth endpoint will do.
• Tested vulnerable: BIG-IP 21.1.0 (build 0.0.38). Tested fixed: 21.1.0.2 (hotfix build 0.30.22).

What to do

• Apply the fix from K000162605, which watchTowr confirmed in 21.1.0.2.
• Check whether any virtual server uses an APM OAuth profile, since that is the exposed surface.
• Hunt for requests to OAuth endpoints with an Authorization header over 0x4100 bytes. Also look for unexpected tmm crashes and for edits to /etc/bigstart/scripts/tmm.finish.

Caveats

• watchTowr published no working RCE payload beyond the file-touch proof of concept.
• The 90% heap-layout reliability and the object layout are from watchTowr's own lab runs. watchTowr says it guessed the object's members.
• The page gives no workaround short of patching.