CVE-2026-104939
7.5HighPublished 14 Oct 2026 · NVD status: Awaiting Analysis · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
- Impact
- High impact on confidentiality
- Weakness
- CWE-303
Impact
Remote, unauthenticated attackers can bypass external authentication and access protected ingress paths. They only need network access to HTTP endpoints configured with externalAuth policies.
Root cause
The ingress controller mishandles HTTP responses from external OAuth identity providers during externalAuth evaluation.
Affected systems
Versions not listed — check the vendor advisory.
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Fix & remediation
Upgrade to the patched NGINX Ingress Controller release listed in F5 advisory K000162617. If patching immediately is not possible, disable or avoid relying on externalAuth policies for sensitive routes until patched.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
Description NGINX Ingress Controller has a vulnerability when implementing an externalAuth policy for ingress. NGINX Ingress Controller may mishandle the HTTP response from an OAuth IdP and allow an attacker to acquire unauthenticated access to protected paths before the proper external authentication can happen. Impact This vulnerability may allow remote attackers unauthenticated access to protected paths. There is no control plane exposure; this is a data plane issue only. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.