SB2026101475 - Multiple vulnerabilities in NGINX Gateway Fabric

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026101475

SB2026101475 - Multiple vulnerabilities in NGINX Gateway Fabric

Published: October 14, 2026

Security Bulletin ID SB2026101475
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities 2
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

Medium 50% Low 50%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 2 vulnerabilities.


1) Authentication Bypass by Spoofing (CVE-ID: CVE-2026-96615)

CWE-ID: CWE-290 - Authentication Bypass by Spoofing

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to read TLS private keys of Gateway deployments in another namespace.

The vulnerability exists due to authentication bypass by spoofing in the Gateway CRD feature of NGINX Gateway Fabric when handling authenticated gRPC connections with NGINX Agent. A remote user can impersonate the authenticated NGINX Agent gRPC connection to read TLS private keys of Gateway deployments in another namespace.

Exploitation requires access to a namespaced service account. This issue affects only the control plane; there is no data plane exposure.


2) Improper Neutralization of Equivalent Special Elements (CVE-ID: CVE-2026-91184)

CWE-ID: CWE-76 - Improper Neutralization of Equivalent Special Elements

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to disclose sensitive information, perform server-side request forgery, and hijack other tenants' routes.

The vulnerability exists due to improper neutralization of equivalent special elements in the AuthenticationFilter CRD of NGINX Gateway Fabric when rendering spec.basic.realm and spec.jwt.realm verbatim into the shared data plane nginx.conf without escaping or validation. A remote user can submit a crafted realm value that closes the quoted directive and enclosing location block and injects arbitrary NGINX directives to disclose sensitive information, perform server-side request forgery, and hijack other tenants' routes.

Exploitation requires Kubernetes RBAC write access to AuthenticationFilter CRDs and Secrets, and configuring the filter for an HTTPRoute or GRPCRoute on a shared Gateway. The issue is exposed only through the control plane, not the data plane.


Remediation

Install update from vendor's website.

References