Executive brief
NGINX Gateway Fabric is a tool used to manage network traffic for modern applications. A security flaw in its configuration generator allows users with specific administrative permissions to inject unauthorized commands into the system's underlying configuration. This could allow an attacker to bypass security controls or gain unauthorized access to sensitive data managed by the gateway.
Technical details
An injection vulnerability exists in the NGINX configuration generator component of NGINX Gateway Fabric when NGINX Plus is used as the data plane. The root cause is the lack of sanitization or escaping for user-supplied string values in the 'serverTokens' field of the NginxProxy Custom Resource Definition (CRD) and the 'extraAuthArgs' field of the AuthenticationFilter CRD. These values are rendered directly into NGINX configuration templates. An authenticated attacker with permissions to create or modify these CRDs can inject arbitrary NGINX configuration directives. While this is a control plane issue, it allows for significant manipulation of the gateway's behavior. The vulnerability is addressed in version 2.6.4.
Affected products
- F5 NGINX Gateway Fabric 2.5.0 to 2.6.4
Timeline
- 2026-06-17: disclosed
- 2026-06-17: advisory