CVE-2026-94197: NGINX Ingress Controller vulnerability
An authentication and authorization bypass vulnerability exists in F5 NGINX Kubernetes Ingress Controller (NIC) when configured with the ExternalAuth policy or Ingress external authentication. Client-supplied X-Forwarded-Prefix, X-Forwarded-URI, X-Original-URI, and X-Forwarded-Method routing and method headers are forwarded unsanitized into the internal authentication subrequest (handled by the NGINX authrequest directive). As a result, an unauthenticated, remote attacker may spoof request attributes evaluated by the external authentication provider.
Impact: This vulnerability may allow remote attackers
unauthenticated
access to protected
paths. There is no control plane exposure; this is a data plane issue only.
Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
F5 NGINX Kubernetes Ingress Controller deployments are affected when they use the ExternalAuth policy or Ingress external authentication. The issue affects data-plane request handling only; there is no control-plane exposure described.
What does an attacker need to exploit it?
An unauthenticated remote attacker needs to be able to send requests to an affected ingress endpoint. They can supply spoofed X-Forwarded-Prefix, X-Forwarded-URI, X-Original-URI, or X-Forwarded-Method headers that are evaluated by the external authentication provider.
What is the likely impact of successful exploitation?
Successful exploitation may let an attacker bypass authentication and authorization checks for protected paths. The provided impact information identifies confidentiality impact as high, with no stated integrity or availability impact.