NGINX Ingress Controller has a vulnerability when implementing an externalAuth policy for ingress. NGINX Ingress Controller may mishandle the HTTP response from an OAuth IdP and allow an attacker to acquire unauthenticated access to protected paths before the proper external authentication can happen.
Impact
This vulnerability may allow remote attackers
unauthenticated
access to protected
paths. There is no control plane exposure; this is a data plane issue only.
Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| F5 | NGINX Ingress Controller | unknown |
|
No data.
No data.
No data.
Project Subscriptions
No data.
No advisories yet.
Solution
No solution given by the vendor.
Workaround
None
| Link | Providers |
|---|---|
| https://my.f5.com/manage/s/article/K000162617 |
|
Wed, 14 Oct 2026 15:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | Description NGINX Ingress Controller has a vulnerability when implementing an externalAuth policy for ingress. NGINX Ingress Controller may mishandle the HTTP response from an OAuth IdP and allow an attacker to acquire unauthenticated access to protected paths before the proper external authentication can happen. Impact This vulnerability may allow remote attackers unauthenticated access to protected paths. There is no control plane exposure; this is a data plane issue only. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. | |
| Title | NGINX Ingress Controller vulnerability | |
| Weaknesses | CWE-303 | |
| References |
| |
| Metrics |
cvssV3_1
|
Projects
Sign in to view the affected projects.
MITRE
Status: PUBLISHED
Assigner: f5
Published:
Updated: 2026-10-14T14:40:30.052Z
Reserved: 2026-10-02T17:24:33.310Z
Link: CVE-2026-104939
Vulnrichment
No data.
NVD
Status : Awaiting Analysis
Published: 2026-10-14T15:17:05.260
Modified: 2026-10-14T16:04:11.750
Link: CVE-2026-104939
Redhat
No data.
OpenCVE Enrichment
No data.