Improper Neutralization of Equivalent Special Elements in NGINX Gateway Fabric - CVE-2026-91184
Published: October 14, 2026
Vulnerability details
The vulnerability allows a remote user to disclose sensitive information, perform server-side request forgery, and hijack other tenants' routes.
The vulnerability exists due to improper neutralization of equivalent special elements in the AuthenticationFilter CRD of NGINX Gateway Fabric when rendering spec.basic.realm and spec.jwt.realm verbatim into the shared data plane nginx.conf without escaping or validation. A remote user can submit a crafted realm value that closes the quoted directive and enclosing location block and injects arbitrary NGINX directives to disclose sensitive information, perform server-side request forgery, and hijack other tenants' routes.
Exploitation requires Kubernetes RBAC write access to AuthenticationFilter CRDs and Secrets, and configuring the filter for an HTTPRoute or GRPCRoute on a shared Gateway. The issue is exposed only through the control plane, not the data plane.