SB2026101476 - Multiple vulnerabilities in NGINX Ingress Controller

Description

This security bulletin contains information about 2 vulnerabilities.

1) Authentication Bypass by Spoofing (CVE-ID: CVE-2026-94197)

CWE-ID: CWE-290 - Authentication Bypass by Spoofing

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to access protected paths without authentication.

The vulnerability exists due to improper sanitization of client-supplied routing and method headers in the external authentication handling of NGINX Ingress Controller when forwarding headers into internal authentication subrequests handled by the NGINX auth_request directive. A remote attacker can supply spoofed X-Forwarded-Prefix, X-Forwarded-URI, X-Original-URI, and X-Forwarded-Method headers to access protected paths without authentication.

The issue affects configurations using the ExternalAuth policy or Ingress external authentication where the external authentication provider evaluates the forwarded request attributes. Exposure is limited to the data plane; the control plane is not exposed.

2) Incorrect Implementation of Authentication Algorithm (CVE-ID: CVE-2026-104939)

CWE-ID: CWE-303 - Incorrect Implementation of Authentication Algorithm

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to bypass external authentication and access protected paths.

The vulnerability exists due to incorrect implementation of the authentication algorithm in the externalAuth policy implementation of NGINX Ingress Controller when handling HTTP responses from an OAuth identity provider. A remote attacker can request protected paths before proper external authentication completes to bypass external authentication and access protected paths.

The issue is limited to the data plane; there is no control plane exposure.

Remediation

Install update from vendor's website.

References

• https://my.f5.com/manage/s/article/K000162611
• https://my.f5.com/manage/s/article/K000162617