Injection Vulnerability in NGINX Gateway Fabric Affecting NGINX Plus and Open Source

CVE-2026-50107

What is CVE-2026-50107?

An injection vulnerability has been identified in the NGINX Gateway Fabric when utilized as a data plane for NGINX Plus and NGINX Open Source. This issue arises in the NGINX configuration generator component, where user-supplied string values from the NginxProxy Custom Resource Definition (CRD) access log format are directly rendered into NGINX configuration templates without appropriate sanitization or escaping. An attacker with authenticated access, capable of creating or modifying these CRDs, may exploit this flaw to inject arbitrary NGINX configuration directives, potentially compromising the integrity of the control plane. There is no exposure through the data plane from the triggering event of the vulnerability.

References