SB2026061843 - Multiple vulnerabilities in NGINX Gateway Fabric

Description

This security bulletin contains information about 3 vulnerabilities.

1) Improper Validation of Array Index (CVE-ID: CVE-2026-32682)

CWE-ID: CWE-129 - Improper Validation of Array Index

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to improper validation of array index in the GRPCRoute handling logic when processing GRPCRoute configurations containing backendRef filters. A remote user can send a malformed GRPCRoute configuration to cause a denial of service.

The issue affects the control plane only and causes the control plane process to terminate and enter a persistent crash loop while the malformed GRPCRoute resource remains in the cluster.

2) Improper Neutralization of Equivalent Special Elements (CVE-ID: CVE-2026-50107)

CWE-ID: CWE-76 - Improper Neutralization of Equivalent Special Elements

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote user to inject arbitrary NGINX configuration directives.

The vulnerability exists due to improper neutralization of equivalent special elements in the NGINX configuration generator component when rendering user-supplied NginxProxy CRD access log format values into NGINX configuration templates. A remote user can supply crafted CRD values to inject arbitrary NGINX configuration directives.

This is a control plane issue only; there is no data plane exposure from the vulnerability trigger itself.

3) Improper Neutralization of Equivalent Special Elements (CVE-ID: CVE-2026-11311)

CWE-ID: CWE-76 - Improper Neutralization of Equivalent Special Elements

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote user to inject arbitrary NGINX configuration directives.

The vulnerability exists due to improper neutralization of equivalent special elements in the NGINX configuration generator component when rendering user-supplied values from the NginxProxy serverTokens field or the AuthenticationFilter extraAuthArgs field into NGINX configuration templates. A remote user can create or modify these custom resource definitions with crafted values to inject arbitrary NGINX configuration directives.

This is a control plane issue only and affects deployments that use NGINX Plus as the data plane.

Remediation

Install update from vendor's website.

References

• https://my.f5.com/manage/s/article/K000161786
• https://my.f5.com/manage/s/article/K000161785
• https://my.f5.com/manage/s/article/K000161611