CVE-2026-32682: NGINX Gateway Fabric vulnerability
When NGINX Gateway Fabric is configured using GRPCRoutes, an authenticated, remote attacker with permission to create or modify GRPCRoute resources can cause the NGINX Gateway Fabric control plane to terminate by sending undisclosed GRPCRoute configurations containing backendRef filters.
Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-32682?
CVE-2026-32682 has a medium severity rating of 6.5.
How do I fix CVE-2026-32682?
To mitigate CVE-2026-32682, ensure proper access controls are enforced on GRPCRoutes and limit permissions to create or modify resources.
What impact does CVE-2026-32682 have on NGINX Gateway Fabric?
CVE-2026-32682 allows an authenticated remote attacker to terminate the NGINX Gateway Fabric control plane.
Who is affected by CVE-2026-32682?
Users of NGINX Gateway Fabric who allow the creation or modification of GRPCRoute resources are at risk from CVE-2026-32682.
What specific configurations are involved in CVE-2026-32682?
CVE-2026-32682 involves the use of GRPCRoute configurations containing backendRef filters.