Authentication and Authorization Bypass in F5 NGINX Kubernetes Ingress Controller
CVE-2026-94197

8.7HIGH

Key Information:

Vendor

F5
Status
Nginx Ingress Controller
Vendor
CVE Published:
14 October 2026

What is CVE-2026-94197?

The F5 NGINX Kubernetes Ingress Controller contains a vulnerability that allows for bypassing authentication and authorization measures when utilizing the ExternalAuth policy. This occurs due to the unsanitized passing of client-supplied headers, such as X-Forwarded-Prefix and X-Original-URI, into the internal authentication subrequest processed by the NGINX auth_request directive. Consequently, this flaw can enable unauthenticated remote attackers to manipulate request attributes assessed by the external authentication system, potentially granting access to protected resources.

Affected Version(s)

NGINX Ingress Controller 5.5.0 < 5.7.0

References

https://my.f5.com/manage/s/article/K000162611
vendor-advisory

CVSS V4

Score:
8.7
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

F5 acknowledges Luke Granto for bringing this issue to our attention and following the highest standards of coordinated disclosure.
.