NGINX Gateway Fabric
CVE-2026-11311
HIGH
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Kubernetes API is network-reachable (AV:N), exploit is straightforward string injection (AC:L), requires authenticated CRD edit rights (PR:L), no user interaction, and yields full control-plane config control affecting confidentiality and integrity but not directly availability.
Primary rating from Vendor (f5).
CVSS VectorVendor: f5
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Lifecycle Timeline
1DescriptionCVE.org
When NGINX Plus is configured as the data plane for NGINX Gateway Fabric, an injection vulnerability exists in the NGINX configuration generator component of NGINX Gateway Fabric. User-supplied string values from the NginxProxy Custom Resource Definition serverTokens field and the AuthenticationFilter Custom Resource Definition extraAuthArgs field are rendered directly into NGINX configuration templates without sanitization or escaping. An authenticated attacker with permission to create or modify these Custom Resource Definitions may craft values that inject arbitrary NGINX configuration directives. This is a control plane issue; there is no data plane exposure from the vulnerability trigger itself.
Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Articles & Coverage 1
AnalysisAI
Configuration injection in NGINX Gateway Fabric (when paired with NGINX Plus as the data plane) allows an authenticated Kubernetes user with rights over the NginxProxy or AuthenticationFilter Custom Resource Definitions to inject arbitrary NGINX directives into generated configuration. The flaw lives in the control-plane configuration generator, which renders user-supplied values from the serverTokens and extraAuthArgs CRD fields directly into NGINX templates without sanitization or escaping. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The deployment must be NGINX Gateway Fabric configured with NGINX Plus as its data plane; the attacker must hold Kubernetes RBAC permissions to create, update, or patch either the NginxProxy CRD (to abuse the serverTokens field) or the AuthenticationFilter CRD (to abuse the extraAuthArgs field) in a namespace consumed by the gateway. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | Multiple signals are consistent: the CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) describes a network-reachable, low-complexity attack that nonetheless requires authenticated access (PR:L) to the Kubernetes API with permission to create or modify the relevant CRDs - typically a cluster operator or namespace admin, not an anonymous internet attacker. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A namespace tenant or compromised service account with permission to create AuthenticationFilter or NginxProxy resources submits a CRD whose extraAuthArgs or serverTokens field contains an embedded newline followed by attacker-chosen NGINX directives - for example, adding a server block, a proxy_pass to an attacker-controlled upstream, or directives that disable TLS verification. When NGINX Gateway Fabric regenerates configuration and NGINX Plus reloads, the injected directives take effect across the shared data plane, allowing the attacker to redirect traffic, exfiltrate request data, or weaken security controls for other tenants. … |
| Remediation | Patch available per vendor advisory - consult F5 article K000161611 (https://my.f5.com/manage/s/article/K000161611) for the fixed NGINX Gateway Fabric release and upgrade accordingly; exact fix versions are not enumerated in the provided data, so do not rely on a version number until confirmed in the vendor advisory. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Audit all Kubernetes RBAC bindings granting create/update/delete permissions on NginxProxy and AuthenticationFilter CRDs; document current access holders. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Share
External POC / Exploit Code
Leaving vuln.today