Which versions of NGINX Gateway Fabric are affected by CVE-2026-11311?

F5 NGINX Gateway Fabric contains a configuration injection vulnerability allowing authenticated Kubernetes users with NginxProxy or AuthenticationFilter resource access to inject arbitrary NGINX…

How to fix or mitigate CVE-2026-11311?

Within 24 hours: Identify all F5 NGINX Gateway Fabric deployments and audit which Kubernetes service accounts and users hold create/modify RBAC permissions on NginxProxy and AuthenticationFilter Custom Resources. Within 7 days: Implement least-privilege RBAC policies restricting these permissions to authorized administrators only; enable Kubernetes audit logging with 90-day retention for all modifications to these resource types. Within 30 days: Deploy Kubernetes admission webhooks (OPA/Gatekeeper or native ValidatingWebhook) to block or restrict serverTokens and extraAuthArgs field modifications; subscribe to F5 advisories and test patches in staging environment.

NGINX Gateway Fabric CVE-2026-11311

Q: What is the CVSS score of CVE-2026-11311?

CVE-2026-11311 has a CVSS 4.0 base score of 8.6 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.4%.

HIGH

Improper Neutralization of Equivalent Special Elements (CWE-76)

2026-06-17 f5

Nginx Code Injection Nginx Gateway Fabric

8.6

CVSS 4.0 · Vendor: f5

Severity by source

Vendor (f5) PRIMARY

8.6 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.1 HIGH

Reached over the Kubernetes API (AV:N/AC:L) but gated by RBAC write access to specific CRDs (PR:L), no user interaction; unescaped config injection yields high confidentiality and integrity impact with no direct availability loss.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (f5).

CVSS VectorVendor: f5

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Updated

Jul 02, 2026 - 20:13 vuln.today

v3 (cvss_changed)

Analysis Updated

Jul 02, 2026 - 20:13 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jul 02, 2026 - 20:07 vuln.today

cvss_changed

CVSS changed

Jul 02, 2026 - 20:07 NVD

8.1 (HIGH) 8.6 (HIGH)

Analysis Generated

Jun 17, 2026 - 15:32 vuln.today

DescriptionCVE.org

When NGINX Plus is configured as the data plane for NGINX Gateway Fabric, an injection vulnerability exists in the NGINX configuration generator component of NGINX Gateway Fabric. User-supplied string values from the NginxProxy Custom Resource Definition serverTokens field and the AuthenticationFilter Custom Resource Definition extraAuthArgs field are rendered directly into NGINX configuration templates without sanitization or escaping. An authenticated attacker with permission to create or modify these Custom Resource Definitions may craft values that inject arbitrary NGINX configuration directives. This is a control plane issue; there is no data plane exposure from the vulnerability trigger itself.

Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Articles & Coverage 2

News 4 New Nginx Vulnerabilities - 4 High Severity Jun 18, 2026 News 4 New Nginx Vulnerabilities - 1 Critical, 3 High Severity Jun 17, 2026

AnalysisAI

Configuration injection in F5 NGINX Gateway Fabric lets an authenticated Kubernetes user who can create or modify NginxProxy or AuthenticationFilter Custom Resources inject arbitrary NGINX directives into generated data-plane configuration. The flaw lives in the control-plane config generator, which renders the serverTokens and extraAuthArgs fields into NGINX templates without escaping, so any tenant holding RBAC rights over these CRDs can rewrite the NGINX Plus config that gets deployed. There is no public exploit identified at time of analysis and EPSS is low (0.36%), but SSVC rates the technical impact as total.

Technical ContextAI

NGINX Gateway Fabric is F5's Kubernetes Gateway API implementation; its control plane translates Kubernetes Custom Resources into NGINX (here NGINX Plus) data-plane configuration through a template-based config generator. The defect is a template injection: string values taken verbatim from the NginxProxy CRD serverTokens field and the AuthenticationFilter CRD extraAuthArgs field are interpolated into the nginx.conf template without sanitization or escaping. This maps to CWE-76 (Improper Neutralization of Equivalent Special Elements) - the generator fails to neutralize NGINX-significant syntax, so an attacker-controlled string can close the intended context and open new directive blocks. The affected component is identified in CPE data as cpe:2.3:a:f5:nginx_gateway_fabric, and exploitation is only relevant when NGINX Plus is configured as the data plane.

RemediationAI

Patch available per vendor advisory - consult F5 article K000161611 (https://my.f5.com/manage/s/article/K000161611) for the fixed release and upgrade NGINX Gateway Fabric accordingly; no exact fix version is provided in the available data, so confirm it directly with F5. As compensating controls until patched, tighten Kubernetes RBAC so that only trusted administrators can create or modify NginxProxy and AuthenticationFilter Custom Resources (remove create/update/patch verbs on these CRDs from tenant and application service accounts), which directly removes the attacker's entry point at the cost of restricting self-service config for legitimate teams. Additionally, deploy an admission controller (e.g. OPA/Gatekeeper or Kyverno) policy that validates or rejects serverTokens and extraAuthArgs values containing NGINX-significant characters such as ';', '{', '}', and newlines, accepting that overly strict rules may block legitimate custom values. Audit existing NginxProxy and AuthenticationFilter resources for already-injected directives before and after remediation.