Which versions of NGINX Gateway Fabric are affected by CVE-2026-50107?

F5 NGINX Gateway Fabric contains a configuration injection vulnerability affecting authenticated Kubernetes users, enabling attackers to inject arbitrary NGINX directives through manipulated resource…

How to fix or mitigate CVE-2026-50107?

Within 24 hours: Inventory deployments of F5 NGINX Gateway Fabric and identify which teams have Kubernetes permissions to create/modify NginxProxy Custom Resource Definitions. Within 7 days: Implement restrictive RBAC policies limiting NginxProxy CRD modification to essential service accounts; enable audit logging for all CRD changes. Within 30 days: Monitor F5 security advisories for patch availability; evaluate alternative ingress/gateway solutions if patch timeline extends beyond acceptable risk window.

NGINX Gateway Fabric CVE-2026-50107

Q: What is the CVSS score of CVE-2026-50107?

CVE-2026-50107 has a CVSS 4.0 base score of 8.6 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

HIGH

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)

2026-06-17 f5

Nginx Code Injection Nginx Gateway Fabric

8.6

CVSS 4.0 · Vendor: f5

Severity by source

Vendor (f5) PRIMARY

8.6 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

9.0 CRITICAL

Requires Kubernetes RBAC over NginxProxy CRDs (PR:H), network-reachable API (AV:N/AC:L), and control-plane-to-data-plane crossing justifies S:C with high C/I and low availability impact.

3.1 AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:L

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:L/SC:L/SI:L/SA:N

Primary rating from Vendor (f5).

CVSS VectorVendor: f5

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Updated

Jun 18, 2026 - 03:45 vuln.today

v3 (cvss_changed)

Analysis Updated

Jun 18, 2026 - 03:45 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jun 18, 2026 - 03:38 vuln.today

cvss_changed

CVSS changed

Jun 18, 2026 - 03:38 NVD

8.1 (HIGH) 8.6 (HIGH)

Analysis Generated

Jun 17, 2026 - 20:32 vuln.today

DescriptionCVE.org

When NGINX Plus or NGINX Open Source is configured as the data plane for NGINX Gateway Fabric, an injection vulnerability exists in the NGINX configuration generator component of NGINX Gateway Fabric. User-supplied string values from the NginxProxy Custom Resource Definition (CRD) access log format setting are rendered directly into NGINX configuration templates without sanitization or escaping. An authenticated attacker with permission to create or modify these CRDs may craft values that inject arbitrary NGINX configuration directives. This is a control plane issue; there is no data plane exposure from the vulnerability trigger itself.

Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Articles & Coverage 1

News 4 New Nginx Vulnerabilities - 4 High Severity Jun 18, 2026

AnalysisAI

Configuration injection in F5 NGINX Gateway Fabric allows an authenticated Kubernetes user with permission to create or modify NginxProxy Custom Resource Definitions to inject arbitrary NGINX directives into generated configuration files via the unsanitized access log format setting. The flaw resides in the control plane configuration generator and affects deployments using NGINX Plus or NGINX Open Source as the data plane. There is no public exploit identified at time of analysis, and CVSS 4.0 rates the impact at 8.6 (High) driven by high confidentiality and integrity loss on the vulnerable system.

Technical ContextAI

NGINX Gateway Fabric is F5's Kubernetes Gateway API implementation that translates Gateway, HTTPRoute, and proxy custom resources into NGINX configuration consumed by data plane pods. The NginxProxy CRD exposes operator-controlled tuning knobs including the access log format, whose string values are rendered directly into NGINX configuration templates by the control plane's config generator. Because the templating step omits escaping and sanitization, this is a textbook CWE-74 (Improper Neutralization of Special Elements in Output) injection - the attacker controls a template variable that becomes structurally meaningful NGINX directives once rendered. The affected component is the control plane only (cpe:2.3:a:f5:nginx_gateway_fabric); F5 explicitly notes the data plane itself is not directly exposed by the trigger, though the injected directives are ultimately loaded by data plane NGINX instances.

RemediationAI

Patch availability per vendor advisory: upgrade NGINX Gateway Fabric to the fixed release identified in F5 advisory K000161785 (https://my.f5.com/manage/s/article/K000161785); exact fix versions are not enumerated in the input data and must be taken from the advisory. Until patched, restrict Kubernetes RBAC so that only trusted cluster operators can create or update NginxProxy CRDs (verbs create/update/patch on the nginxproxies resource in the gateway.nginx.org API group), since the vulnerability is gated entirely by that permission - note this trade-off limits self-service tuning by namespace owners. Additionally consider admission-control policies (Kyverno, OPA Gatekeeper, or ValidatingAdmissionPolicy) that reject NginxProxy resources whose access log format contains newline, semicolon, or NGINX directive keywords, accepting that overly strict regex may also block legitimate format strings. Audit existing NginxProxy CRDs for suspicious access log format values before applying upgrades.