CVE-2026-11311: NGINX Gateway Fabric vulnerability
When NGINX Plus is configured as the data plane for NGINX Gateway Fabric, an injection vulnerability exists in the NGINX configuration generator component of NGINX Gateway Fabric. User-supplied string values from the NginxProxy Custom Resource Definition serverTokens field and the AuthenticationFilter Custom Resource Definition extraAuthArgs field are rendered directly into NGINX configuration templates without sanitization or escaping. An authenticated attacker with permission to create or modify these Custom Resource Definitions may craft values that inject arbitrary NGINX configuration directives. This is a control plane issue; there is no data plane exposure from the vulnerability trigger itself.
Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-11311?
The severity of CVE-2026-11311 is rated high with a score of 8.6.
How do I fix CVE-2026-11311?
To fix CVE-2026-11311, ensure you update NGINX Plus to the latest version that addresses this vulnerability.
What components are affected by CVE-2026-11311?
CVE-2026-11311 specifically affects the NGINX configuration generator component of NGINX Gateway Fabric.
What type of vulnerability is CVE-2026-11311?
CVE-2026-11311 is an injection vulnerability stemming from user-supplied input within NGINX configuration.
Who is impacted by CVE-2026-11311?
Organizations using NGINX Plus as the data plane for NGINX Gateway Fabric may be impacted by CVE-2026-11311.