Which versions of NGINX Gateway Fabric are affected by CVE-2026-32682?

F5 NGINX Gateway Fabric contains a denial-of-service vulnerability allowing authenticated Kubernetes administrators to crash the control plane through malformed configuration objects, creating risk…

How to fix or mitigate CVE-2026-32682?

24 hours: Identify all F5 NGINX Gateway Fabric deployments and document versions; restrict Kubernetes RBAC permissions for GRPCRoute resource creation/modification to principal administrators only. 7 days: Enable audit logging for all GRPCRoute changes and implement alerting for control plane crashes or unexpected restarts. 30 days: Monitor F5 security advisories and vendor channels for patch availability; maintain compensating controls until patched version is released.

NGINX Gateway Fabric CVE-2026-32682

Q: What is the CVSS score of CVE-2026-32682?

CVE-2026-32682 has a CVSS 4.0 base score of 7.1 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

HIGH

Improper Validation of Array Index (CWE-129)

2026-06-17 f5

Nginx Information Disclosure Nginx Gateway Fabric

7.1

CVSS 4.0 · Vendor: f5

Severity by source

Vendor (f5) PRIMARY

7.1 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.5 MEDIUM

Network-reachable Kubernetes API (AV:N), no special conditions (AC:L), requires RBAC rights on GRPCRoute resources (PR:L), no user interaction, availability-only impact on the control plane.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (f5).

CVSS VectorVendor: f5

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Updated

Jun 18, 2026 - 03:44 vuln.today

v3 (cvss_changed)

Analysis Updated

Jun 18, 2026 - 03:44 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jun 18, 2026 - 03:38 vuln.today

cvss_changed

Severity Changed

Jun 18, 2026 - 03:38 NVD

MEDIUM HIGH

CVSS changed

Jun 18, 2026 - 03:38 NVD

6.5 (MEDIUM) 7.1 (HIGH)

Analysis Generated

Jun 17, 2026 - 20:35 vuln.today

DescriptionCVE.org

When NGINX Gateway Fabric is configured using GRPCRoutes, an authenticated, remote attacker with permission to create or modify GRPCRoute resources can cause the NGINX Gateway Fabric control plane to terminate by sending undisclosed GRPCRoute configurations containing backendRef filters.

Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

AnalysisAI

Denial-of-service in F5 NGINX Gateway Fabric allows an authenticated Kubernetes user with rights to create or modify GRPCRoute resources to crash the control plane by submitting GRPCRoute objects containing malformed backendRef filters. The flaw, tracked under CWE-129 (Improper Validation of Array Index), carries a CVSS 4.0 score of 7.1 with pure availability impact and no public exploit identified at time of analysis.

Technical ContextAI

NGINX Gateway Fabric is F5's Kubernetes-native implementation of the Gateway API, translating Gateway, HTTPRoute, and GRPCRoute custom resources into NGINX data-plane configuration. GRPCRoute objects expose a backendRef field that supports filter chains for traffic shaping; per CWE-129 (Improper Validation of Array Index), the control plane fails to bounds-check or otherwise validate elements of this filter list when reconciling the resource, allowing a crafted configuration to terminate the reconciler process. Because the control plane mediates all routing updates for the cluster gateway, a crash interrupts configuration propagation for every workload it serves. The affected CPE is cpe:2.3:a:f5:nginx_gateway_fabric (all versions evaluated; End-of-Technical-Support releases are out of scope).

RemediationAI

Patch available per vendor advisory: upgrade NGINX Gateway Fabric to the fixed release identified in F5 article K000161786 (https://my.f5.com/manage/s/article/K000161786); the exact fix version is not enumerated in the available input and should be taken from that advisory. Until upgrade, restrict Kubernetes RBAC so that create/update/patch on gateway.networking.k8s.io/grpcroutes is granted only to trusted service accounts and platform operators - this is the most direct compensating control, with the trade-off that tenants who legitimately self-service gRPC routing must instead submit changes via GitOps or an admission-gated pipeline. As a secondary control, deploy a validating admission webhook (or an OPA/Kyverno policy) that rejects GRPCRoute objects with backendRef filters until the patch is applied; this blocks the attack path but also blocks legitimate filter use, so scope the policy narrowly. Running multiple control-plane replicas does not fix the bug but limits blast radius if one replica is crashed by a malformed resource.