CWE-76 vulnerabilities

CVE-2026-91184 is a vulnerability in F5 NGINX Gateway Fabric affecting versions 2.4.0 up to but not including 2.8.0. It involves improper handling of the spec.basic.realm and spec.jwt.realm fields in the AuthenticationFilter CRD, allowing an authenticated attacker to inject arbitrary NGINX directives into the shared data-plane configuration. This can lead to unauthorized access to co-located tenants' secrets, SSRF attacks, and hijacking of tenant routes. The issue affects the control plane only, with no direct data plane exposure.

When NGINX Ingress Controller is configured with Ingress annotations, an injection vulnerability exists in the configuration generator of NGINX Ingress Controller. Multiple user-controllable fields are written into the generated NGINX configuration without sanitization. An authenticated attacker with permission to create or modify these annotations may craft values that inject arbitrary NGINX configuration directives. Impact: An authenticated attacker granted write access to NGINX Ingress Controller Ingress annotations through the Kubernetes API may be able to inject arbitrary NGINX configuration directives, create or delete files, or disable services. There is no data plane exposure; this is a control plane issue only. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Description: When NGINX Plus is configured as the data plane for NGINX Gateway Fabric, an injection vulnerability exists in the NGINX configuration generator component of NGINX Gateway Fabric. User-supplied string values from the Authentication Filter Custom Resource Definition clientID or cookieName fields, or in the clientSecret field of a Secret referenced by an Authentication Filter, are rendered directly into NGINX configuration templates without sanitization or escaping. Impact: An authenticated attacker with permission to create or modify these resources may craft values that inject arbitrary NGINX configuration directives. This is a control plane issue; there is no data plane exposure.

CVE-2026-54722 is a high-severity vulnerability in the dssrf-js Node.js library prior to version 1.0.4. The issue involves improper neutralization of special elements in URL processing, specifically the '@' userinfo delimiter. This flaw allows an attacker to bypass internal IP validation checks, potentially causing a client to access internal services via crafted URLs. The vulnerability is fixed in version 1.0.4.

When NGINX Ingress Controller is configured with Custom Resource Definitions (CRDs) or Ingress annotations, an injection vulnerability exists in the configuration generator of NGINX Ingress Controller. Multiple user-controllable fields are written into the generated NGINX configuration without sanitization. An authenticated attacker with permission to create or modify these CRDs or annotations may craft values that inject arbitrary NGINX configuration directives. Impact: An authenticated attacker granted write access to NGINX Ingress Controller CRDs or Ingress annotations through the Kubernetes API may be able to inject arbitrary NGINX configuration directives, create or delete files, or disable services. There is no data plane exposure; this is a control plane issue only. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

CVE-2026-11311 is an injection vulnerability in the NGINX configuration generator component of F5's NGINX Gateway Fabric version 2.5.0. Authenticated users with permission to create or modify certain Custom Resource Definitions can inject arbitrary NGINX configuration directives via unsanitized fields. There is no direct data plane exposure from this vulnerability. No official patch or remediation guidance is currently provided.