EUVD-2026-70139
GHSA-94x9-2xmh-58p8
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network vector via Kubernetes API; PR:L because specific RBAC write permission is required, not anonymous; no availability impact per vendor statement.
Primary rating from Vendor (f5).
CVSS VectorVendor: f5
Lifecycle Timeline
4DescriptionCVE.org
Description: When NGINX Plus is configured as the data plane for NGINX Gateway Fabric, an injection vulnerability exists in the NGINX configuration generator component of NGINX Gateway Fabric. User-supplied string values from the Authentication Filter Custom Resource Definition clientID or cookieName fields, or in the clientSecret field of a Secret referenced by an Authentication Filter, are rendered directly into NGINX configuration templates without sanitization or escaping.
Impact: An authenticated attacker with permission to create or modify these resources may craft values that inject arbitrary NGINX configuration directives. This is a control plane issue; there is no data plane exposure.
Articles & Coverage 1
AnalysisAI
Configuration injection in NGINX Gateway Fabric allows authenticated Kubernetes users with CRD or Secret write permissions to embed arbitrary NGINX directives into the generated server configuration. The vulnerability originates in the NGINX configuration generator component, which renders Authentication Filter fields - clientID, cookieName, and clientSecret - directly into configuration templates without sanitization. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires two concrete prerequisites: (1) the attacker must hold a valid Kubernetes credential with RBAC permission to create or update Authentication Filter CRD objects or Kubernetes Secrets referenced by them in the target namespace - this is not a default permission for standard user roles; and (2) NGINX Gateway Fabric must be deployed with NGINX Plus as the data plane and the Authentication Filter feature must be configured (i.e., Authentication Filter CRDs must be in use). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 8.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) reflects that exploitation is network-reachable via the Kubernetes API server and requires only low-privilege access - specifically, RBAC permission to create or modify Authentication Filter resources or Secrets in the relevant namespace. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | The primary remediation is to apply the vendor-supplied fix referenced in F5 advisory K000162600 at https://my.f5.com/manage/s/article/K000162600; a specific patched release version was not independently confirmed from the available data, so administrators should consult the advisory directly to identify the target upgrade version. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, audit all Kubernetes RBAC policies to identify users and service accounts with CRD and Secret write permissions; restrict these permissions to essential administrator accounts and enable Kubernetes audit logging for all CRD/Secret modifications. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Nginx Gateway Fabric
View allConfiguration injection in F5 NGINX Gateway Fabric lets an authenticated Kubernetes user who can create or modify NginxP
Configuration injection in F5 NGINX Gateway Fabric allows an authenticated Kubernetes user with permission to create or
Denial-of-service in F5 NGINX Gateway Fabric allows an authenticated Kubernetes user with rights to create or modify GRP
NGINX proxy configurations forwarding traffic to upstream TLS servers can be exploited by network-positioned attackers t
Same technique Code Injection
View allShare
External POC / Exploit Code
Leaving vuln.today