Authentication Bypass by Spoofing in NGINX Gateway Fabric - CVE-2026-96615
Published: October 14, 2026
Vulnerability identifier: #VU155763
CSH Severity: Low
CVSS v4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-96615
CWE-ID: CWE-290
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to read TLS private keys of Gateway deployments in another namespace.
The vulnerability exists due to authentication bypass by spoofing in the Gateway CRD feature of NGINX Gateway Fabric when handling authenticated gRPC connections with NGINX Agent. A remote user can impersonate the authenticated NGINX Agent gRPC connection to read TLS private keys of Gateway deployments in another namespace.
Exploitation requires access to a namespaced service account. This issue affects only the control plane; there is no data plane exposure.
Affected software
NGINX Gateway Fabric
How to mitigate CVE-2026-96615
Install security update from vendor's website.
NGINX Gateway Fabric - update to 2.8.0