CVE-2026-96615: NGINX Gateway Fabric vulnerability
Description NGINX Gateway Fabric has a vulnerability when it is configured with Gateway
Custom Resource Definition (CRD) and have an authenticated gRPC connection with NGINX Agent. A namespaced
authenticated attacker with access to a service account may impersonate the authenticated NGINX Agent gRPC connection to read TLS private keys of Gateway deployments in another namespace.
Impact A remote authenticated attacker may be able to read TLS private keys of Gateway deployments in another namespace.
There is no data plane exposure; this is a control plane issue only.
Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Other sources
NGINX Gateway Fabric has a vulnerability when it is configured with Gateway Custom Resource Definition (CRD) and has an authenticated gRPC connection with NGINX Agent. A namespaced authenticated attacker with access to a service account may impersonate the authenticated NGINX Agent gRPC connection to read Transport Layer Security (TLS) private keys of Gateway deployments in another namespace.
— F5
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 2.8.0
Event History
Frequently Asked Questions
Who is exposed to this issue?
Deployments of NGINX Gateway Fabric configured with the Gateway CRD and using an authenticated gRPC connection with NGINX Agent are exposed. The impact is limited to the control plane; no data plane exposure is described.
What access does an attacker need?
An attacker needs to be authenticated, namespaced, and have access to a service account. With that access, they may impersonate the authenticated NGINX Agent gRPC connection.
What could an attacker obtain?
An attacker may be able to read TLS private keys belonging to Gateway deployments in another namespace. The described impact is confidentiality-only.
Are end-of-technical-support versions covered by the evaluation?
No. Software versions that have reached End of Technical Support are not evaluated.