7.5
Élevée
CVE-2026-104939 Description NGINX Ingress Controller has a vulnerability when implementing an externalAuth policy for ingress
Description
Description NGINX Ingress Controller has a vulnerability when implementing an externalAuth policy for ingress. NGINX Ingress Controller may mishandle the HTTP response from an OAuth IdP and allow an attacker to acquire unauthenticated access to protected paths before the proper external authentication can happen. Impact This vulnerability may allow remote attackers unauthenticated access to protected paths. There is no control plane exposure; this is a data plane issue only. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| NGINX Ingress Controller 5.6 | 5.6.0 → < 5.7.0 | 5.7.0 |
Références
- my.f5.com my.f5.com
Chronologie
- Publiée
- Dernière modification
Autres CVE de NGINX Ingress Controller
Les 8 CVE de NGINX Ingress Controller →
CVE-2026-94197
An authentication and authorization bypass vulnerability exists in F5 NGINX Kubernetes Ingress Controller (NIC) when…
7.5
Élevée
CVE-2026-77180
When NGINX Ingress Controller is configured with Ingress annotations, an injection vulnerability exists in the…
8.3
Élevée
CVE-2026-52865
When NGINX Ingress Controller processes Ingress or TransportServer resources, an authenticated, remote attacker with…
6.5
Moyenne
CVE-2026-55723
When NGINX Ingress Controller is configured with Custom Resource Definitions (CRDs) or Ingress annotations, an injection…
8.3
Élevée