CVE-2026-94197: CWE-290 Authentication Bypass by Spoofing in F5 NGINX Ingress Controller

An authentication and authorization bypass vulnerability (CWE-290) exists in F5 NGINX Kubernetes Ingress Controller versions >=5.5.0 and <5.7.0 when configured with ExternalAuth or Ingress external authentication. The vulnerability arises because certain client-supplied headers related to routing and HTTP methods are forwarded without sanitization into the internal authentication subrequest handled by the NGINX auth_request directive. This allows an unauthenticated remote attacker to spoof request attributes that the external authentication provider evaluates, potentially bypassing authentication and gaining unauthorized access to protected resources. The vulnerability impacts only the data plane and does not affect the control plane. The CVSS v3.1 base score is 7.5 (high severity) with network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, high confidentiality impact, and no integrity or availability impact. No official patch or remediation details are provided in the source data.

Remote unauthenticated attackers may bypass authentication and authorization controls by spoofing routing and method headers, gaining unauthorized access to protected paths on the data plane. The control plane is not affected. Confidentiality is impacted as unauthorized access to protected resources is possible. There is no reported impact on integrity or availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid using the ExternalAuth policy or Ingress external authentication configurations that forward client-supplied X-Forwarded-Prefix, X-Forwarded-URI, X-Original-URI, and X-Forwarded-Method headers unsanitized. Monitor vendor communications for updates and apply official patches once released.