CVE-2026-91184
8.8HighPublished 14 Oct 2026 · NVD status: Awaiting Analysis · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
- Impact
- Full C/I/A compromise
- Weakness
- CWE-76
Impact
Authenticated tenants can inject arbitrary NGINX directives into the shared data-plane configuration to steal secrets, read pod service account tokens, trigger SSRF, or hijack routes. An attacker only needs permission to create or modify AuthenticationFilter custom resources within their Kubernetes namespace.
Root cause
NGINX Gateway Fabric renders the spec.basic.realm and spec.jwt.realm fields into nginx.conf without validation or escaping, allowing directive and block injection.
Affected systems
Versions not listed — check the vendor advisory.
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Fix & remediation
Upgrade NGINX Gateway Fabric to the patched release referenced in advisory K000162609. If patching immediately is not possible, restrict or revoke RBAC permissions for untrusted tenants to create or edit AuthenticationFilter custom resources.
$ kubectl get crd authenticationfilters.gateway.nginx.orgAI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
Description NGINX Gateway Fabric has a vulnerability when it renders the spec.basic.realm (and spec.jwt.realm) field of a namespaced AuthenticationFilter verbatim, unescaped and unvalidated, into the shared data-plane nginx.conf as auth_basic "<realm>";. A namespaced authenticated attacker that configures AuthenticationFilter CRD to an HTTPRoute/GRPCRoute on a shared Gateway can craft a realm value that closes the quoted directive and the enclosing location {} block and injects arbitrary NGINX directives into that Gateway's data-plane config. Impact A remote authenticated attacker can send crafted requests to configure NGINX Gateway Fabric AuthenticationFilter CRD and may be able to read every co-located tenant's mounted secrets, SSRF via proxy_pass, reading the pod ServiceAccount token, or hijacking other tenants' routes. There is no data plane exposure; this is a control plane issue only. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.