Injection Vulnerability in NGINX Plus Configuration by F5 Networks

CVE-2026-11311

What is CVE-2026-11311?

An injection vulnerability has been identified in the NGINX configuration generator within NGINX Plus when utilized as the data plane for NGINX Gateway Fabric. This flaw arises from how user-inputted string values from the Custom Resource Definition fields, namely serverTokens and extraAuthArgs, are directly incorporated into NGINX configuration templates without appropriate sanitization or escaping. This oversight allows an authenticated attacker, who has permission to alter these Custom Resource Definitions, to inject arbitrary NGINX configuration directives, potentially compromising the security of the configuration. It's important to note that this issue pertains to the control plane, with no direct exposure from the data plane triggered by the vulnerability activities.

References