CVE-2026-104939

Awaiting Analysis Awaiting Analysis - Queue

Unauthenticated Access in NGINX Ingress Controller via OAuth IdP Response

Publication date: 2026-10-14

Last updated on: 2026-10-15

Assigner: F5 Networks

Description

Description NGINX Ingress Controller has a vulnerability when implementing an externalAuth policy for ingress. NGINX Ingress Controller may mishandle the HTTP response from an OAuth IdP and allow an attacker to acquire unauthenticated access to protected paths before the proper external authentication can happen. Impact This vulnerability may allow remote attackers unauthenticated access to protected paths. There is no control plane exposure; this is a data plane issue only. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-15

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-104939

EUVD

EUVD-2026-101122

Affected Vendors & Products

Vendor	Product	Version / Range
F5	NGINX	Ingress Controller 5.6.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-303	The requirements for the product dictate the use of an established authentication algorithm, but the implementation of the algorithm is incorrect.

Attack-Flow Graph

Executive Summary

NGINX Ingress Controller has a flaw in its externalAuth policy implementation. When using OAuth identity providers, the controller may incorrectly process HTTP responses, allowing attackers to bypass authentication and gain unauthenticated access to protected paths before proper external authentication occurs.

Impact Analysis

This vulnerability allows remote attackers to access protected paths without authentication. It does not affect the control plane but exposes data plane resources. Attackers could steal sensitive data or perform unauthorized actions on systems relying on NGINX Ingress Controller for authentication.

Compliance Impact

This vulnerability allows unauthenticated access to protected paths, which could lead to unauthorized exposure of sensitive data. This may violate compliance requirements under GDPR (data protection) and HIPAA (healthcare data privacy) by failing to enforce proper authentication controls.

Mitigation Strategies

Disable or review externalAuth policies in NGINX Ingress Controller configurations to prevent unauthenticated access to protected paths. Ensure OAuth IdP responses are properly validated before granting access.

Hi! I’m here to help you understand CVE-2026-104939. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70