Incorrect Implementation of Authentication Algorithm in NGINX Ingress Controller - CVE-2026-104939
Published: October 14, 2026
Vulnerability identifier: #VU155766
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-104939
CWE-ID: CWE-303
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to bypass external authentication and access protected paths.
The vulnerability exists due to incorrect implementation of the authentication algorithm in the externalAuth policy implementation of NGINX Ingress Controller when handling HTTP responses from an OAuth identity provider. A remote attacker can request protected paths before proper external authentication completes to bypass external authentication and access protected paths.
The issue is limited to the data plane; there is no control plane exposure.
Affected software
NGINX Ingress Controller
How to mitigate CVE-2026-104939
Install security update from vendor's website.
NGINX Ingress Controller - update to 5.7.0