CVE-2026-94197
7.5HighPublished 14 Oct 2026 · NVD status: Awaiting Analysis · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
- Impact
- High impact on confidentiality
- Weakness
- CWE-290
Impact
Remote, unauthenticated attackers can bypass authentication to access protected endpoints. They only need network access to send crafted HTTP headers to the ingress controller.
Root cause
The ingress controller forwards untrusted client-supplied headers (X-Forwarded-Prefix, X-Forwarded-URI, X-Original-URI, and X-Forwarded-Method) unsanitized into auth_request subrequests.
Affected systems
F5 NGINX Kubernetes Ingress Controller configured with ExternalAuth policy or Ingress external authentication (exact version numbers not listed — check the vendor advisory).
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Fix & remediation
Upgrade NGINX Ingress Controller to the fixed release per F5 advisory K000162611. If patching must wait, strip or sanitize incoming client headers (X-Forwarded-Prefix, X-Forwarded-URI, X-Original-URI, X-Forwarded-Method) before authentication processing, or disable ExternalAuth.
$ kubectl get pods -A -l app.kubernetes.io/name=nginx-ingress -o jsonpath='{.items[*].spec.containers[*].image}'AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
An authentication and authorization bypass vulnerability exists in F5 NGINX Kubernetes Ingress Controller (NIC) when configured with the `ExternalAuth` policy or Ingress external authentication. Client-supplied X-Forwarded-Prefix, X-Forwarded-URI, X-Original-URI, and X-Forwarded-Method routing and method headers are forwarded unsanitized into the internal authentication subrequest (handled by the NGINX auth_request directive). As a result, an unauthenticated, remote attacker may spoof request attributes evaluated by the external authentication provider. Impact: This vulnerability may allow remote attackers unauthenticated access to protected paths. There is no control plane exposure; this is a data plane issue only. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.