CVE-2026-50107: NGINX Gateway Fabric vulnerability
When NGINX Plus or NGINX Open Source is configured as the data plane for NGINX Gateway Fabric, an injection vulnerability exists in the NGINX configuration generator component of NGINX Gateway Fabric. User-supplied string values from the NginxProxy Custom Resource Definition (CRD) access log format setting are rendered directly into NGINX configuration templates without sanitization or escaping. An authenticated attacker with permission to create or modify these CRDs may craft values that inject arbitrary NGINX configuration directives. This is a control plane issue; there is no data plane exposure from the vulnerability trigger itself.
Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Restrict who can create or modify NginxProxy Custom Resource (CR) instances and related CRDs using Kubernetes RBAC; limit permissions to trusted administrative users only.
- Compensating control
Restrict network access to the NGINX Gateway Fabric control plane (management/API endpoints) to trusted IPs or networks using firewall rules or network ACLs to reduce exposure of the control plane.
- Operational
Audit all NginxProxy Custom Resources for user-supplied access log format values; remove or sanitize any untrusted or suspicious access log format strings and regenerate/reload the NGINX configuration to ensure injected directives are not present.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-50107?
The severity of CVE-2026-50107 is high with a score of 8.1.
How do I fix CVE-2026-50107?
To mitigate CVE-2026-50107, update to the latest patch of NGINX Plus or NGINX Open Source that addresses the vulnerability.
What impact does CVE-2026-50107 have on my NGINX deployment?
CVE-2026-50107 can lead to potential injection attacks due to user-supplied string values in the NGINX configuration generator.
Which versions of NGINX are affected by CVE-2026-50107?
CVE-2026-50107 affects NGINX Plus and NGINX Open Source when configured as the data plane for NGINX Gateway Fabric.
Is CVE-2026-50107 exploitable remotely?
Yes, CVE-2026-50107 is classified as having an attack vector that is network-based, making it remotely exploitable.