NGINX Ingress Controller Vulnerability Exposes Protected Paths
CVE-2026-104939

8.7HIGH

Key Information:

Vendor

F5
Status
Nginx Ingress Controller
Vendor
CVE Published:
14 October 2026

What is CVE-2026-104939?

The NGINX Ingress Controller is susceptible to a vulnerability arising from the implementation of an externalAuth policy for ingress. This flaw may allow attackers to exploit improperly handled HTTP responses from an OAuth Identity Provider (IdP), resulting in potential unauthorized access to protected paths. It is crucial to secure these paths to prevent malicious access and ensure comprehensive authentication before accessing sensitive resources.

Affected Version(s)

NGINX Ingress Controller 5.6.0 < 5.7.0

References

https://my.f5.com/manage/s/article/K000162617
vendor-advisory

CVSS V4

Score:
8.7
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

F5 acknowledges Carl Liljencrantz for bringing this issue to our attention and following the highest standards of coordinated disclosure.
.