CVE-2026-94197

Awaiting Analysis Awaiting Analysis - Queue

Authentication Bypass in F5 NGINX Kubernetes Ingress Controller

Publication date: 2026-10-14

Last updated on: 2026-10-15

Assigner: F5 Networks

Description

An authentication and authorization bypass vulnerability exists in F5 NGINX Kubernetes Ingress Controller (NIC) when configured with the `ExternalAuth` policy or Ingress external authentication. Client-supplied X-Forwarded-Prefix, X-Forwarded-URI, X-Original-URI, and X-Forwarded-Method routing and method headers are forwarded unsanitized into the internal authentication subrequest (handled by the NGINX auth_request directive). As a result, an unauthenticated, remote attacker may spoof request attributes evaluated by the external authentication provider. Impact: This vulnerability may allow remote attackers unauthenticated access to protected paths. There is no control plane exposure; this is a data plane issue only. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-15

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-94197

EUVD

EUVD-2026-101118

Affected Vendors & Products

Vendor	Product	Version / Range
F5	NGINX	Ingress Controller 5.5.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-290	This attack-focused weakness is caused by incorrectly implemented authentication schemes that are subject to spoofing attacks.

Attack-Flow Graph

Executive Summary

This vulnerability is an authentication and authorization bypass in F5 NGINX Kubernetes Ingress Controller when using ExternalAuth or Ingress external authentication. Unsanitized client-supplied headers like X-Forwarded-Prefix, X-Forwarded-URI, X-Original-URI, and X-Forwarded-Method are forwarded to the internal authentication subrequest. This allows unauthenticated attackers to spoof request attributes evaluated by the external authentication provider.

Detection Guidance

Check NGINX Ingress Controller logs for unusual authentication subrequests or requests with suspicious X-Forwarded headers. Inspect network traffic for requests containing X-Forwarded-Prefix, X-Forwarded-URI, X-Original-URI, or X-Forwarded-Method headers that may indicate spoofing attempts.

Impact Analysis

This vulnerability may allow remote attackers to gain unauthenticated access to protected paths. It is limited to the data plane and does not expose the control plane. Attackers could bypass authentication mechanisms to access sensitive resources.

Compliance Impact

This vulnerability allows unauthenticated remote access to protected paths, which could lead to unauthorized data exposure or modification. This may violate compliance requirements under GDPR (data protection) and HIPAA (healthcare data security) by enabling unauthorized access to sensitive information.

Mitigation Strategies

Apply the latest security patches or updates provided by F5 for the NGINX Kubernetes Ingress Controller. Disable or restrict the use of ExternalAuth policies and external authentication headers until patched. Review and sanitize all incoming X-Forwarded headers to prevent header injection.

Hi! I’m here to help you understand CVE-2026-94197. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70