Is CVE-2026-40460 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-40460 being exploited in the wild.

How severe is CVE-2026-40460?

Medium severity, with a CVSS score of 6.5, published 13 May 2026.

Which products and versions are affected?

F5 Nginx Gateway Fabric 1.3.0-1.6.2, 2.0.0-2.6.0; F5 Nginx Ingress Controller 3.5.0-3.7.2, 4.0.0-4.0.1, 5.0.0-5.4.2; F5 Nginx Plus R32 through R36 P3.

Is there a fix for CVE-2026-40460?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-40460 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-40460?

Check whether you run F5 Nginx Gateway Fabric, F5 Nginx Ingress Controller, F5 Nginx Plus or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-40460: F5 NGINX IP address spoofing in HTTP/3 QUIC module

CVE-2026-40460 · Severity: medium · CVSS 6.5 · Published 2026-05-13

NGINX Plus and NGINX Open Source are widely used web server and reverse proxy solutions. A security flaw in the HTTP/3 QUIC module allows remote attackers to fake their source IP address. This could enable unauthorized users to bypass security restrictions, such as access controls or rate limits, potentially leading to unauthorized data access or service degradation.

Technologies: F5 Nginx Gateway Fabric, F5 Nginx Ingress Controller, F5 Nginx Plus, NGINX Open Source. Vendors: F5, NGINX.

Quick answers

Is CVE-2026-40460 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-40460 being exploited in the wild.
How severe is CVE-2026-40460?: Medium severity, with a CVSS score of 6.5, published 13 May 2026.
Which products and versions are affected?: F5 Nginx Gateway Fabric 1.3.0-1.6.2, 2.0.0-2.6.0; F5 Nginx Ingress Controller 3.5.0-3.7.2, 4.0.0-4.0.1, 5.0.0-5.4.2; F5 Nginx Plus R32 through R36 P3.
Is there a fix for CVE-2026-40460?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-40460 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-40460?: Check whether you run F5 Nginx Gateway Fabric, F5 Nginx Ingress Controller, F5 Nginx Plus or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A vulnerability classified as 'Authentication Bypass by Spoofing' (CWE-290) exists in the ngx_quic_module of NGINX Plus and NGINX Open Source. When configured to use HTTP/3 QUIC, the software fails to properly validate or protect the source IP address, allowing a remote, unauthenticated attacker to spoof their identity. This spoofing can be leveraged to circumvent security policies that rely on IP-based authorization or rate limiting. The issue affects NGINX Open Source versions 1.25.0 through 1.30.0 and NGINX Plus versions R32 through R36. F5 has released updates (e.g., NGINX Open Source 1.30.1 and NGINX Plus R36 P4) to address this behavior.

Affected products

F5 NGINX Plus R32 through R36 P3
F5 NGINX Open Source 1.25.0 through 1.30.0
F5 NGINX Ingress Controller 3.5.0-3.7.2, 4.0.0-4.0.1, 5.0.0-5.4.2
F5 NGINX Gateway Fabric 1.3.0-1.6.2, 2.0.0-2.6.0

Timeline

2026-05-13: advisory
2026-05-13: disclosed

References

https://my.f5.com/manage/s/article/K000161068

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.