CVE-2026-104939

F5 NGINX Ingress Controller can mishandle the HTTP response from an OAuth identity provider when an ingress uses an externalAuth policy. A remote attacker can reach protected paths without completing authentication, before the controller applies the proper external auth decision. The impact is unauthorized access to those paths (high confidentiality impact on the data plane); the advisory states there is no control-plane exposure. Only deployments that implement externalAuth are affected, and affected version ranges were not listed (End of Technical Support releases were not evaluated). CISA has not listed this CVE in the Known Exploited Vulnerabilities catalog, and no public proof-of-concept is known.

What to do: Apply the vendor fix for NGINX Ingress Controller as soon as F5 publishes a supported release for your branch; the advisory does not name fixed versions here. Until then, treat ingresses that use an externalAuth (OAuth) policy as potentially reachable without authentication, restrict those paths at the network layer, and review access logs for requests that reached protected backends without a completed IdP check. This is a data-plane issue only; control-plane exposure is not indicated.