Authentication Bypass by Spoofing in NGINX Ingress Controller - CVE-2026-94197
Published: October 14, 2026
Vulnerability details
The vulnerability allows a remote attacker to access protected paths without authentication.
The vulnerability exists due to improper sanitization of client-supplied routing and method headers in the external authentication handling of NGINX Ingress Controller when forwarding headers into internal authentication subrequests handled by the NGINX auth_request directive. A remote attacker can supply spoofed X-Forwarded-Prefix, X-Forwarded-URI, X-Original-URI, and X-Forwarded-Method headers to access protected paths without authentication.
The issue affects configurations using the ExternalAuth policy or Ingress external authentication where the external authentication provider evaluates the forwarded request attributes. Exposure is limited to the data plane; the control plane is not exposed.