Nginx Gateway Fabric
Monthly
Configuration injection in NGINX Gateway Fabric (when paired with NGINX Plus as the data plane) allows an authenticated Kubernetes user with rights over the NginxProxy or AuthenticationFilter Custom Resource Definitions to inject arbitrary NGINX directives into generated configuration. The flaw lives in the control-plane configuration generator, which renders user-supplied values from the serverTokens and extraAuthArgs CRD fields directly into NGINX templates without sanitization or escaping. No public exploit identified at time of analysis, and the CVSS 8.1 rating reflects high confidentiality and integrity impact via the control plane rather than direct data-plane exposure.
NGINX proxy configurations forwarding traffic to upstream TLS servers can be exploited by network-positioned attackers to inject unencrypted data into proxied responses, potentially compromising data integrity. This vulnerability affects NGINX OSS, NGINX Plus, and related products when specific upstream server conditions are present. No patch is currently available for this medium-severity issue.
Configuration injection in NGINX Gateway Fabric (when paired with NGINX Plus as the data plane) allows an authenticated Kubernetes user with rights over the NginxProxy or AuthenticationFilter Custom Resource Definitions to inject arbitrary NGINX directives into generated configuration. The flaw lives in the control-plane configuration generator, which renders user-supplied values from the serverTokens and extraAuthArgs CRD fields directly into NGINX templates without sanitization or escaping. No public exploit identified at time of analysis, and the CVSS 8.1 rating reflects high confidentiality and integrity impact via the control plane rather than direct data-plane exposure.
NGINX proxy configurations forwarding traffic to upstream TLS servers can be exploited by network-positioned attackers to inject unencrypted data into proxied responses, potentially compromising data integrity. This vulnerability affects NGINX OSS, NGINX Plus, and related products when specific upstream server conditions are present. No patch is currently available for this medium-severity issue.