Injection Vulnerability in NGINX Gateway Fabric by NGINX
CVE-2026-66362

8.6HIGH

Key Information:

Vendor

F5
Status
Nginx Gateway Fabric
Vendor
CVE Published:
2 September 2026

What is CVE-2026-66362?

An injection vulnerability has been identified in the configuration generator component of NGINX Gateway Fabric when used as a data plane for NGINX Plus. This vulnerability arises from the rendering of user-supplied string values from the Authentication Filter Custom Resource Definition fields, such as clientID or cookieName, as well as the clientSecret field from a referenced Secret. These values are directly integrated into NGINX configuration templates without proper sanitization or escaping, potentially allowing authenticated attackers to manipulate configuration directives. This vulnerability pertains specifically to the control plane, with no exposure on the data plane.

Affected Version(s)

NGINX Gateway Fabric 2.5.0 < 2.6.8

References

https://my.f5.com/manage/s/article/K000162600
vendor-advisory

CVSS V4

Score:
8.6
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

F5 acknowledges Rushit Palesha (GitHub: rushitgit) and Sujal Tuladhar (EvilGenius) for bringing this issue to our attention and following the highest standards of coordinated disclosure.
.