CVE-2026-66362

NGINX Gateway Fabric, when configured with NGINX Plus as its data plane, has an injection flaw (CWE-76) in its NGINX configuration generator: user-supplied values from the AuthenticationFilter Custom Resource's clientID and cookieName fields, or the clientSecret of a referenced Secret, are written directly into NGINX configuration templates without sanitization or escaping. An authenticated attacker who holds Kubernetes permissions to create or modify these resources can craft field values that inject arbitrary NGINX configuration directives into the generated config. Successful injection yields high-impact confidentiality and integrity effects on the affected gateway per the CVSS 4.0 score of 8.6 (network vector, low privileges, no user interaction), though the vendor notes this is a control-plane issue with no data plane exposure. Affected users are organizations running NGINX Gateway Fabric with an NGINX Plus data plane where less-privileged users can manage AuthenticationFilter resources or their Secrets. No public proof-of-concept, KEV listing, or known exploitation exists, and EPSS estimates only a 0.3% probability of exploitation in the next 30 days.

What to do: Upgrade NGINX Gateway Fabric to the fixed release once identified in the F5 advisory (fixed versions are not given in this data). In the meantime, restrict cluster permissions so only trusted operators can create or modify AuthenticationFilter resources and the Secrets supplying clientSecret, and audit existing clientID, cookieName, and clientSecret values for embedded NGINX directives or unexpected braces/semicolons.