CVE-2026-91184

Awaiting Analysis Awaiting Analysis - Queue

NGINX Gateway Fabric AuthenticationFilter Injection Vulnerability

Publication date: 2026-10-14

Last updated on: 2026-10-15

Assigner: F5 Networks

Description

Description NGINX Gateway Fabric has a vulnerability when it renders the spec.basic.realm (and spec.jwt.realm) field of a namespaced AuthenticationFilter verbatim, unescaped and unvalidated, into the shared data-plane nginx.conf as auth_basic "<realm>";. A namespaced authenticated attacker that configures AuthenticationFilter CRD to an HTTPRoute/GRPCRoute on a shared Gateway can craft a realm value that closes the quoted directive and the enclosing location {} block and injects arbitrary NGINX directives into that Gateway's data-plane config. Impact A remote authenticated attacker can send crafted requests to configure NGINX Gateway Fabric AuthenticationFilter CRD and may be able to read every co-located tenant's mounted secrets, SSRF via proxy_pass, reading the pod ServiceAccount token, or hijacking other tenants' routes. There is no data plane exposure; this is a control plane issue only. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-15

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-91184

EUVD

EUVD-2026-101116

Affected Vendors & Products

Vendor	Product	Version / Range
F5	NGINX	Gateway Fabric 2.4.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-76	The product correctly neutralizes certain special elements, but it improperly neutralizes equivalent special elements.

Attack-Flow Graph

Executive Summary

NGINX Gateway Fabric has a flaw where it directly inserts unescaped and unvalidated realm values from AuthenticationFilter CRDs into the nginx.conf configuration. This allows an attacker to inject arbitrary NGINX directives by crafting a malicious realm value that closes the quoted directive and enclosing location block.

Detection Guidance

This vulnerability is a control plane issue in NGINX Gateway Fabric where crafted AuthenticationFilter CRD configurations can inject arbitrary NGINX directives. Detection requires reviewing AuthenticationFilter CRD configurations for malicious realm values that close quoted directives or location blocks. Check NGINX Gateway Fabric logs and generated nginx.conf files for unexpected directives or syntax errors.

Impact Analysis

A remote authenticated attacker could exploit this to read co-located tenants' secrets, perform SSRF via proxy_pass, access pod ServiceAccount tokens, or hijack other tenants' routes. This is a control plane issue with no direct data plane exposure.

Compliance Impact

This vulnerability primarily impacts data confidentiality and access control, which are critical for compliance with standards like GDPR and HIPAA. A remote authenticated attacker could exploit this to read co-located tenants' mounted secrets, potentially exposing sensitive data such as personal or health information. This could lead to violations of GDPR's data protection requirements or HIPAA's safeguards for protected health information.

Mitigation Strategies

Immediately update NGINX Gateway Fabric to the latest patched version to prevent realm field injection. Review all AuthenticationFilter CRDs for suspicious realm values that may close directives or inject arbitrary NGINX commands. Restrict access to the control plane API to trusted users only.

Hi! I’m here to help you understand CVE-2026-91184. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70