CVE-2026-96615: CWE-290 Authentication Bypass by Spoofing in F5 NGINX Gateway Fabric

F5 NGINX Gateway Fabric versions from 2.0.0 up to but not including 2.8.0 contain an authentication bypass vulnerability (CWE-290) when configured with Gateway CRD and an authenticated gRPC connection to the NGINX Agent. An attacker with authenticated access to a service account within a namespace can spoof the NGINX Agent's gRPC connection, allowing them to read TLS private keys of Gateway deployments in other namespaces. This vulnerability affects only the control plane and does not impact the data plane.

A remote authenticated attacker with access to a service account in one namespace can impersonate the NGINX Agent's authenticated gRPC connection and read TLS private keys of Gateway deployments in other namespaces. This compromises the confidentiality of TLS private keys, potentially undermining the security of encrypted communications for those Gateway deployments. There is no impact on the data plane, limiting the scope to control plane exposure.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to service accounts and minimize the number of principals with authenticated access to the NGINX Agent gRPC connection to reduce risk.