F5-K000162610: Medium severity F5 NGINX Gateway Fabric vulnerability
NGINX Gateway Fabric has a vulnerability when it is configured with Gateway Custom Resource Definition (CRD) and has an authenticated gRPC connection with NGINX Agent. A namespaced authenticated attacker with access to a service account may impersonate the authenticated NGINX Agent gRPC connection to read Transport Layer Security (TLS) private keys of Gateway deployments in another namespace.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 2.8.0
Event History
Frequently Asked Questions
Who is exposed to this issue?
Deployments are exposed when NGINX Gateway Fabric is configured with the Gateway CRD and has an authenticated gRPC connection with NGINX Agent. The attacker must have namespaced access to a service account.
What does an attacker need to do to exploit it?
An authenticated attacker with access to a service account in a namespace must impersonate the authenticated NGINX Agent gRPC connection. Successful impersonation can allow the attacker to read TLS private keys from Gateway deployments in another namespace.
What is the impact if exploitation succeeds?
The disclosed impact is unauthorized reading of TLS private keys belonging to Gateway deployments in another namespace. The provided severity vector indicates no stated integrity or availability impact.