NGINX Gateway Fabric CVE-2026-91184

Requires a MULTI-TENANT deployment where one NGINX Gateway Fabric data plane / Gateway is shared across namespaces, AND an attacker holding namespaced RBAC permissions to create an AuthenticationFilter CRD and attach it (via spec.basic.realm or spec.jwt.realm) to an HTTPRoute or GRPCRoute bound to that shared Gateway. The injectable surface is specifically the realm field rendered verbatim into auth_basic "<realm>";. Limiting factors: exploitation is impossible without valid authenticated namespaced credentials/RBAC (PR:L); single-tenant or per-tenant-dedicated Gateway deployments do not expose cross-tenant impact; the issue is control-plane only with no data-plane exposure; and End-of-Technical-Support versions are explicitly not evaluated. No end-user interaction (UI:N) is needed.

This is a credible, above-average-priority control-plane vulnerability in multi-tenant deployments, but not an emergency for most operators. The F5-provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N, VC:H/VI:H/VA:H) scores 8.7 (High) and is internally consistent with the description: a network-reachable Kubernetes control-plane operation, low complexity, and low-but-nonzero privileges (PR:L - the attacker must already hold namespaced credentials able to create/attach AuthenticationFilter CRDs). CWE-76 (improper neutralization of equivalent special elements) accurately captures the quote/brace-breakout config injection into the shared nginx.conf. No EPSS score was provided, this CVE is NOT in CISA KEV, and no public POC was supplied - so exploitation status is 'no public exploit identified at time of analysis'. The gap between a high CVSS and the absence of any exploitation signal suggests this is a serious-but-not-yet-weaponized issue whose real risk is tightly bounded by deployment model: it only matters where a single shared Gateway serves multiple untrusted tenants, which the description itself frames as a control-plane-only (no data-plane exposure) tenant-isolation break. Note one tension worth verifying with the vendor: the 4.0 vector sets subsequent-system impact to N (SC:N/SI:N/SA:N), yet the described impact (reading OTHER tenants' secrets, hijacking OTHER tenants' routes, stealing the pod ServiceAccount token) is precisely a cross-tenant/cross-authority effect that a scope-aware reading would elevate.

A tenant with namespaced RBAC rights on a cluster whose NGINX Gateway Fabric data plane is shared across tenants creates an AuthenticationFilter CRD and attaches it to an HTTPRoute (or GRPCRoute) on the shared Gateway. They set spec.basic.realm (or spec.jwt.realm) to a value that closes the auth_basic "..."; directive and the enclosing location {} block, then appends attacker-chosen NGINX directives (e.g. a proxy_pass for SSRF, or a block mounting/reading co-tenant secrets and the ServiceAccount token). No public exploit code is known, and AC:L/PR:L mean the attack is technically simple once the attacker holds valid namespaced credentials on a shared Gateway.