59 matches found
CVE-2026-96615
Description NGINX Gateway Fabric has a vulnerability when it is configured with Gateway Custom Resource Definition CRD and have an authenticated gRPC connection with NGINX Agent. A namespaced authenticated attacker with access to a service account may impersonate the authenticated NGINX Agent gRP...
CVE-2026-91184
Description NGINX Gateway Fabric has a vulnerability when it renders the spec.basic.realm and spec.jwt.realm field of a namespaced AuthenticationFilter verbatim, unescaped and unvalidated, into the shared data-plane nginx.conf as authbasic "";. A namespaced authenticated attacker that configures...
EUVD-2026-101117
Description NGINX Gateway Fabric has a vulnerability when it is configured with Gateway Custom Resource Definition CRD and have an authenticated gRPC connection with NGINX Agent. A namespaced authenticated attacker with access to a service account may impersonate the authenticated NGINX Agent gRP...
CVE-2026-96615 NGINX Gateway Fabric vulnerability
Description NGINX Gateway Fabric has a vulnerability when it is configured with Gateway Custom Resource Definition CRD and have an authenticated gRPC connection with NGINX Agent. A namespaced authenticated attacker with access to a service account may impersonate the authenticated NGINX Agent gRP...
CVE-2026-96615
A vulnerability in NGINX Gateway Fabric (versions 2.0.0 - 2.7.2 ) allows a namespaced authenticated attacker with access to a service account to impersonate an authenticated NGINX Agent gRPC connection. This occurs when the software is configured with the Gateway Custom Resource Definition (CRD) ...
CVE-2026-91184 NGINX Gateway Fabric vulnerability
Description NGINX Gateway Fabric has a vulnerability when it renders the spec.basic.realm and spec.jwt.realm field of a namespaced AuthenticationFilter verbatim, unescaped and unvalidated, into the shared data-plane nginx.conf as authbasic "";. A namespaced authenticated attacker that configures...
CVE-2026-91184
NGINX Gateway Fabric (versions 2.4.0 - 2.7.2 ) is vulnerable to a control plane issue where it renders the spec.basic.realm and spec.jwt.realm fields of a namespaced AuthenticationFilter CRD verbatim and unvalidated into the shared data-plane nginx.conf . A namespaced authenticated attacker can c...
EUVD-2026-101116
Description NGINX Gateway Fabric has a vulnerability when it renders the spec.basic.realm and spec.jwt.realm field of a namespaced AuthenticationFilter verbatim, unescaped and unvalidated, into the shared data-plane nginx.conf as authbasic "";. A namespaced authenticated attacker that configures...
K000163408: Out-of-band Security Notification (October 14, 2026)
Security Advisory Description On October 14, 2026, F5 announced the following security issues. This document is intended to serve as an index of these vulnerabilities to help determine the impact to your F5 devices. You can find the details of each issue in the associated articles. Article CVE|...
K000162610: NGINX Gateway Fabric vulnerability CVE-2026-96615
Security Advisory Description NGINX Gateway Fabric has a vulnerability when it is configured with Gateway Custom Resource Definition CRD and has an authenticated gRPC connection with NGINX Agent. A namespaced authenticated attacker with access to a service account may impersonate the authenticate...
K000162609: NGINX Gateway Fabric vulnerability CVE-2026-91184
Security Advisory Description NGINX Gateway Fabric has a vulnerability when it renders spec.basic.realm and spec.jwt.realm of a namespaced AuthenticationFilter Custom Resource Definition CRD verbatim, unescaped and unvalidated, into the shared data plane nginx.conf as authbasic "";. A namespaced...
PT-2026-114333
🚨 CVE-2026-91184 Description NGINX Gateway Fabric has a vulnerability when it renders the spec.basic.realm and spec.jwt.realm field of a namespaced AuthenticationFilter verbatim, unescaped and unvalidated, into the shared data-plane nginx.conf as auth basic "";. A namespaced authenticated attacke...
BIT-NGINX-GATEWAY-FABRIC-2026-66362 NGF vulnerability
Description: When NGINX Plus is configured as the data plane for NGINX Gateway Fabric, an injection vulnerability exists in the NGINX configuration generator component of NGINX Gateway Fabric. User-supplied string values from the Authentication Filter Custom Resource Definition clientID or...
PT-2026-88176
Description: When NGINX Plus is configured as the data plane for NGINX Gateway Fabric, an injection vulnerability exists in the NGINX configuration generator component of NGINX Gateway Fabric. User-supplied string values from the Authentication Filter Custom Resource Definition clientID or...
CVE-2026-66362
Description: When NGINX Plus is configured as the data plane for NGINX Gateway Fabric, an injection vulnerability exists in the NGINX configuration generator component of NGINX Gateway Fabric. User-supplied string values from the Authentication Filter Custom Resource Definition clientID or...
CVE-2026-66362 NGF vulnerability
Description: When NGINX Plus is configured as the data plane for NGINX Gateway Fabric, an injection vulnerability exists in the NGINX configuration generator component of NGINX Gateway Fabric. User-supplied string values from the Authentication Filter Custom Resource Definition clientID or...
CVE-2026-66362 NGF vulnerability
Description: When NGINX Plus is configured as the data plane for NGINX Gateway Fabric, an injection vulnerability exists in the NGINX configuration generator component of NGINX Gateway Fabric. User-supplied string values from the Authentication Filter Custom Resource Definition clientID or...
EUVD-2026-70139
Description: When NGINX Plus is configured as the data plane for NGINX Gateway Fabric, an injection vulnerability exists in the NGINX configuration generator component of NGINX Gateway Fabric. User-supplied string values from the Authentication Filter Custom Resource Definition clientID or...
CVE-2026-66362
CVE-2026-66362 is a configuration injection vulnerability in the NGINX configuration generator component of NGINX Gateway Fabric . When NGINX Plus is configured as the data plane, user-supplied values from the AuthenticationFilter CRD (clientID, cookieName) or the clientSecret field of a referenc...
K000162600: NGINX Gateway Fabric vulnerability CVE-2026-66362
Security Advisory Description When NGINX Plus is configured as the data plane for NGINX Gateway Fabric, an injection vulnerability exists in the NGINX configuration generator component of NGINX Gateway Fabric. User-supplied string values from the AuthenticationFilter custom resource definition CR...