CVE-2026-96615

Awaiting Analysis Awaiting Analysis - Queue

NGINX Gateway Fabric TLS Private Key Exposure via gRPC Impersonation

Publication date: 2026-10-14

Last updated on: 2026-10-15

Assigner: F5 Networks

Description

Description NGINX Gateway Fabric has a vulnerability when it is configured with Gateway Custom Resource Definition (CRD) and have an authenticated gRPC connection with NGINX Agent. A namespaced authenticated attacker with access to a service account may impersonate the authenticated NGINX Agent gRPC connection to read TLS private keys of Gateway deployments in another namespace. Impact A remote authenticated attacker may be able to read TLS private keys of Gateway deployments in another namespace. There is no data plane exposure; this is a control plane issue only. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-15

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-96615

EUVD

EUVD-2026-101117

Affected Vendors & Products

Vendor	Product	Version / Range
F5	NGINX	Gateway Fabric 2.0.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-290	This attack-focused weakness is caused by incorrectly implemented authentication schemes that are subject to spoofing attacks.

Attack-Flow Graph

Executive Summary

NGINX Gateway Fabric has a vulnerability when configured with Gateway Custom Resource Definition (CRD) and an authenticated gRPC connection with NGINX Agent. A namespaced authenticated attacker with service account access can impersonate the NGINX Agent gRPC connection to read TLS private keys of Gateway deployments in another namespace.

Detection Guidance

This vulnerability requires detecting unauthorized access to TLS private keys via an authenticated gRPC connection. Monitor NGINX Gateway Fabric logs for unusual gRPC requests or namespace-crossing access attempts. Check for unexpected service account usage or anomalies in Gateway CRD interactions.

Impact Analysis

A remote authenticated attacker may read TLS private keys of Gateway deployments in another namespace. This is a control plane issue with no data plane exposure, meaning it does not directly expose data traffic but compromises cryptographic keys.

Compliance Impact

This vulnerability allows a remote authenticated attacker to read TLS private keys of Gateway deployments in another namespace. This could potentially expose sensitive encrypted data, which may violate compliance requirements under GDPR or HIPAA if such data includes personal or health information.

Mitigation Strategies

Immediately restrict access to the Gateway CRD and NGINX Agent gRPC connection. Ensure service accounts have least privilege and are not over-permissioned. Review and update RBAC policies to prevent namespace impersonation.

Hi! I’m here to help you understand CVE-2026-96615. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70