NGINX Ingress Controller CVE-2026-104939

Exploitation requires the operator to have configured an externalAuth policy for ingress that delegates authentication to an OAuth identity provider - the flaw is in how the controller handles that IdP's HTTP response. Deployments not using externalAuth/OAuth are not affected, making this a non-default-configuration vulnerability rather than a default-state remote bypass. It is strictly a data plane issue with no control plane exposure, and End of Technical Support versions are not evaluated. The limiting factor is the required externalAuth-with-OAuth deployment mode; where present, no attacker authentication or user interaction is needed.

This is a genuine authentication-bypass vulnerability (CWE-303, Incorrect Implementation of Authentication Algorithm) in F5 NGINX Ingress Controller, rated CVSS 7.5 with vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - network-reachable, low-complexity, no privileges and no user interaction, with high confidentiality impact but no integrity or availability impact. The data plane exposure means an attacker who reaches the ingress can obtain unauthenticated access to paths meant to be protected by external OAuth authentication, which is a meaningful priority for any cluster relying on the externalAuth policy. However, the headline CVSS PR:N reflects the *attacker's* lack of privilege, not deployment reality: exploitation is gated on the operator having configured an externalAuth policy backed by an OAuth IdP, so the true exposed population is narrower than the 7.5 score implies. No EPSS score, CISA KEV listing, POC, or SSVC decision data was provided in the input, so there is no signal of active or probable exploitation to corroborate or contradict the CVSS severity - the risk rests on the vector and the bypass nature alone. Net: credible and worth prioritizing for clusters using externalAuth/OAuth protection, but there is no evidence this is being exploited at scale, and the severity should be read as conditional on that specific configuration.

A cluster uses NGINX Ingress Controller with an externalAuth policy delegating authentication to an OAuth identity provider to gate a sensitive internal application. A remote attacker sends a request to a protected path, and because the controller mishandles the IdP's HTTP response, the request is forwarded to the backend before authentication completes, granting access without valid credentials. No public exploit was identified at time of analysis.