8.1
High
CVE-2026-66362 Description: When NGINX Plus is configured as the data plane for NGINX Gateway Fabric, an injection vulnerability exists…
Description
Description: When NGINX Plus is configured as the data plane for NGINX Gateway Fabric, an injection vulnerability exists in the NGINX configuration generator component of NGINX Gateway Fabric. User-supplied string values from the Authentication Filter Custom Resource Definition clientID or cookieName fields, or in the clientSecret field of a Secret referenced by an Authentication Filter, are rendered directly into NGINX configuration templates without sanitization or escaping. Impact: An authenticated attacker with permission to create or modify these resources may craft values that inject arbitrary NGINX configuration directives. This is a control plane issue; there is no data plane exposure.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| NGINX Gateway Fabric 2.5 | 2.5.0 → < 2.6.8 | 2.6.8 |
References
- my.f5.com my.f5.com
Timeline
- Published
- Last modified
Other CVEs of NGINX Gateway Fabric
The 6 CVEs of NGINX Gateway Fabric →
CVE-2026-96615
Description NGINX Gateway Fabric has a vulnerability when it is configured with Gateway Custom Resource Definition…
6.5
Medium
CVE-2026-91184
Description NGINX Gateway Fabric has a vulnerability when it renders the spec.basic.realm (and spec.jwt.realm) field…
8.8
High
CVE-2026-32682
When NGINX Gateway Fabric is configured using GRPCRoutes, an authenticated, remote attacker with permission to create or…
6.5
Medium
CVE-2026-50107
When NGINX Plus or NGINX Open Source is configured as the data plane for NGINX Gateway Fabric, an injection…
8.1
High