NGINX Gateway Fabric CVE-2026-50107

Exploitation requires (1) a deployment of NGINX Gateway Fabric using NGINX Plus or NGINX Open Source as the data plane, (2) an authenticated Kubernetes identity holding RBAC permissions to create or modify NginxProxy Custom Resource Definitions (typically cluster-admin or a delegated operator role with verbs create/update/patch on nginxproxies.gateway.nginx.org), and (3) supply of a malicious string into the access log format setting of that CRD. Limiting factors: no anonymous or unauthenticated network path exists - the attacker must already have a Kubernetes API token with the relevant write verbs - and the bug is purely a control-plane CRD injection, so data plane clients alone cannot trigger it; End of Technical Support versions are explicitly out of scope of the advisory.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N) reflects a network-reachable, low-complexity attack requiring low privileges and no user interaction, with high confidentiality and integrity loss but no availability impact and no scope change to subsequent systems - consistent with an in-cluster control-plane abuse. PR:L is appropriate because the attacker must be an authenticated Kubernetes principal with RBAC rights to mutate NginxProxy CRDs, which is typically a cluster-operator or namespace-admin role rather than an ordinary tenant. There is no public exploit identified at time of analysis and the CVE is not listed on CISA KEV; EPSS data was not provided. Real-world risk is therefore moderate: the bug is reliable and easy to weaponize once the prerequisite RBAC is held, but the prerequisite itself meaningfully narrows the attacker population to insiders or attackers who have already pivoted into a privileged service account.

An attacker who has obtained Kubernetes credentials with edit rights on NginxProxy CRDs - for example a compromised CI service account or a malicious namespace administrator - submits an NginxProxy resource whose accessLog.format field contains a crafted string that terminates the log_format directive and appends additional NGINX directives. When the Gateway Fabric control plane renders this into the data plane configuration, the injected directives (for example, additional server blocks, lua_package_path, or proxy_pass to attacker-controlled upstreams) are loaded by NGINX, enabling traffic interception, credential exfiltration via mirrored requests, or modification of routing behavior. No public exploit code is identified at time of analysis.