Executive brief
NGINX Gateway Fabric is a tool used to manage network traffic for applications running in Kubernetes environments. A security flaw in its configuration generator allows authorized users to inject malicious commands into the system's internal settings. If exploited, an attacker could gain unauthorized control over how the gateway handles traffic, potentially leading to data exposure or service disruption.
Technical details
An injection vulnerability exists in the NGINX configuration generator component of NGINX Gateway Fabric when using NGINX Plus or NGINX Open Source as the data plane. The root cause is the failure to sanitize or escape user-supplied string values from the NginxProxy Custom Resource Definition (CRD) access log format setting before rendering them into NGINX configuration templates. An authenticated attacker with network access and permissions to create or modify these CRDs can inject arbitrary NGINX configuration directives. While this is a control plane issue without direct data plane exposure from the trigger itself, it allows for significant unauthorized configuration changes. The vulnerability affects versions 2.3.0 through 2.6.3 and is addressed in version 2.6.4.
Affected products
- F5 NGINX Gateway Fabric 2.3.0 to 2.6.3
Timeline
- 2026-06-17: disclosed
- 2026-06-17: advisory