{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "NGINX App Protect WAF versions 4.x",
      "product": {
        "name": "NGINX App Protect WAF",
        "vendor": {
          "name": "F5",
          "scada": false
        }
      }
    },
    {
      "description": "NGINX App Protect DoS versions 4.x",
      "product": {
        "name": "NGINX App Protect DoS",
        "vendor": {
          "name": "F5",
          "scada": false
        }
      }
    },
    {
      "description": "NGINX Plus versions ant\u00e9rieures \u00e0 37.1.0.1 et 37.0.5.1",
      "product": {
        "name": "NGINX Plus",
        "vendor": {
          "name": "F5",
          "scada": false
        }
      }
    },
    {
      "description": "NGINX Ingress Controller versions ant\u00e9rieures \u00e0 5.7.0",
      "product": {
        "name": "NGINX Ingress Controller",
        "vendor": {
          "name": "F5",
          "scada": false
        }
      }
    },
    {
      "description": "NGINX Ingress Controller versions 2026-lts-r3 - 2026-lts-r8",
      "product": {
        "name": "NGINX Ingress Controller",
        "vendor": {
          "name": "F5",
          "scada": false
        }
      }
    },
    {
      "description": "NGINX Javascript ant\u00e9rieures \u00e0 1.0.2",
      "product": {
        "name": "NGINX JavaScript (njs)",
        "vendor": {
          "name": "F5",
          "scada": false
        }
      }
    },
    {
      "description": "NGINX Open Source versions 1.31.x ant\u00e9rieures \u00e0 1.31.7",
      "product": {
        "name": "NGINX Open Source",
        "vendor": {
          "name": "F5",
          "scada": false
        }
      }
    },
    {
      "description": "F5 WAF for NGINX versions 5.x ant\u00e9rieures \u00e0 5.14.2 et 5.16.0",
      "product": {
        "name": "F5 WAF for NGINX",
        "vendor": {
          "name": "F5",
          "scada": false
        }
      }
    },
    {
      "description": "NGINX Instance Manager versions 2.x ant\u00e9rieures \u00e0 2.24.0",
      "product": {
        "name": "NGINX Instance Manager",
        "vendor": {
          "name": "F5",
          "scada": false
        }
      }
    },
    {
      "description": "NGINX Open Source versions ant\u00e9rieures \u00e0 1.30.6",
      "product": {
        "name": "NGINX Open Source",
        "vendor": {
          "name": "F5",
          "scada": false
        }
      }
    },
    {
      "description": "NGINX Gateway Fabric versions ant\u00e9rieures \u00e0 2.8.0",
      "product": {
        "name": "NGINX Gateway Fabric",
        "vendor": {
          "name": "F5",
          "scada": false
        }
      }
    },
    {
      "description": "F5 DoS for NGINX versions 4.x ant\u00e9rieures \u00e0 4.11.0",
      "product": {
        "name": "F5 DoS for NGINX",
        "vendor": {
          "name": "F5",
          "scada": false
        }
      }
    },
    {
      "description": "NGINX App Protect WAF versions 5.x",
      "product": {
        "name": "NGINX App Protect WAF",
        "vendor": {
          "name": "F5",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": "",
  "content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
  "cves": [
    {
      "name": "CVE-2026-91184",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-91184"
    },
    {
      "name": "CVE-2026-101019",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-101019"
    },
    {
      "name": "CVE-2026-96615",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-96615"
    },
    {
      "name": "CVE-2026-15176",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-15176"
    },
    {
      "name": "CVE-2026-97205",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-97205"
    },
    {
      "name": "CVE-2026-104939",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-104939"
    },
    {
      "name": "CVE-2026-101025",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-101025"
    },
    {
      "name": "CVE-2026-95101",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-95101"
    },
    {
      "name": "CVE-2026-94197",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-94197"
    },
    {
      "name": "CVE-2026-93479",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-93479"
    },
    {
      "name": "CVE-2026-97629",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-97629"
    }
  ],
  "initial_release_date": "2026-10-19T00:00:00",
  "last_revision_date": "2026-10-19T00:00:00",
  "links": [],
  "reference": "CERTFR-2026-AVI-1341",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2026-10-19T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "D\u00e9ni de service \u00e0 distance"
    },
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    },
    {
      "description": "Non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur"
    },
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    },
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits F5. Certaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer une ex\u00e9cution de code arbitraire \u00e0 distance, un d\u00e9ni de service \u00e0 distance et une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es.",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits F5",
  "vendor_advisories": [
    {
      "published_at": "2026-10-14",
      "title": "Bulletin de s\u00e9curit\u00e9 F5 K000163408",
      "url": "https://my.f5.com/manage/s/article/K000163408"
    },
    {
      "published_at": "2026-10-14",
      "title": "Bulletin de s\u00e9curit\u00e9 F5 K000162615",
      "url": "https://my.f5.com/manage/s/article/K000162615"
    },
    {
      "published_at": "2026-10-14",
      "title": "Bulletin de s\u00e9curit\u00e9 F5 K000162613",
      "url": "https://my.f5.com/manage/s/article/K000162613"
    },
    {
      "published_at": "2026-10-14",
      "title": "Bulletin de s\u00e9curit\u00e9 F5 K000162611",
      "url": "https://my.f5.com/manage/s/article/K000162611"
    },
    {
      "published_at": "2026-10-14",
      "title": "Bulletin de s\u00e9curit\u00e9 F5 K000162606",
      "url": "https://my.f5.com/manage/s/article/K000162606"
    },
    {
      "published_at": "2026-10-14",
      "title": "Bulletin de s\u00e9curit\u00e9 F5 K000162610",
      "url": "https://my.f5.com/manage/s/article/K000162610"
    },
    {
      "published_at": "2026-10-14",
      "title": "Bulletin de s\u00e9curit\u00e9 F5 K000162416",
      "url": "https://my.f5.com/manage/s/article/K000162416"
    },
    {
      "published_at": "2026-10-14",
      "title": "Bulletin de s\u00e9curit\u00e9 F5 K000162609",
      "url": "https://my.f5.com/manage/s/article/K000162609"
    },
    {
      "published_at": "2026-10-14",
      "title": "Bulletin de s\u00e9curit\u00e9 F5 K000162607",
      "url": "https://my.f5.com/manage/s/article/K000162607"
    },
    {
      "published_at": "2026-10-14",
      "title": "Bulletin de s\u00e9curit\u00e9 F5 K000162617",
      "url": "https://my.f5.com/manage/s/article/K000162617"
    },
    {
      "published_at": "2026-10-14",
      "title": "Bulletin de s\u00e9curit\u00e9 F5 K000162614",
      "url": "https://my.f5.com/manage/s/article/K000162614"
    },
    {
      "published_at": "2026-10-14",
      "title": "Bulletin de s\u00e9curit\u00e9 F5 K000162608",
      "url": "https://my.f5.com/manage/s/article/K000162608"
    }
  ]
}

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "NGINX Open Source versions 1.x ant\u00e9rieures \u00e0 1.31.7",
      "product": {
        "name": "NGINX Open Source",
        "vendor": {
          "name": "F5",
          "scada": false
        }
      }
    },
    {
      "description": "F5 WAF for NGINX versions 5.x ant\u00e9rieures \u00e0 5.16.0",
      "product": {
        "name": "F5 WAF for NGINX",
        "vendor": {
          "name": "F5",
          "scada": false
        }
      }
    },
    {
      "description": "NGINX Plus versions 37.x ant\u00e9rieures \u00e0 37.2.0",
      "product": {
        "name": "NGINX Plus",
        "vendor": {
          "name": "F5",
          "scada": false
        }
      }
    },
    {
      "description": "NGINX Instance Manager versions 2.x ant\u00e9rieures \u00e0 2.24.0",
      "product": {
        "name": "NGINX Instance Manager",
        "vendor": {
          "name": "F5",
          "scada": false
        }
      }
    },
    {
      "description": "NGINX Ingress Controller versions 5.x ant\u00e9rieures \u00e0 5.7.0",
      "product": {
        "name": "NGINX Ingress Controller",
        "vendor": {
          "name": "F5",
          "scada": false
        }
      }
    },
    {
      "description": "NGINX Gateway Fabric versions 2.x ant\u00e9rieures \u00e0 2.8.0",
      "product": {
        "name": "NGINX Gateway Fabric",
        "vendor": {
          "name": "F5",
          "scada": false
        }
      }
    },
    {
      "description": "F5 DoS for NGINX versions 4.x ant\u00e9rieures \u00e0 4.11.0",
      "product": {
        "name": "F5 DoS for NGINX",
        "vendor": {
          "name": "F5",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": "",
  "content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
  "cves": [
    {
      "name": "CVE-2026-15176",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-15176"
    },
    {
      "name": "CVE-2026-97205",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-97205"
    },
    {
      "name": "CVE-2026-95101",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-95101"
    },
    {
      "name": "CVE-2026-93479",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-93479"
    },
    {
      "name": "CVE-2026-97629",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-97629"
    }
  ],
  "initial_release_date": "2026-10-15T00:00:00",
  "last_revision_date": "2026-10-15T00:00:00",
  "links": [],
  "reference": "CERTFR-2026-AVI-1317",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2026-10-15T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "D\u00e9ni de service \u00e0 distance"
    },
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    },
    {
      "description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
    },
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits F5. Certaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer une ex\u00e9cution de code arbitraire \u00e0 distance, une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es et une atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es.",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits F5",
  "vendor_advisories": [
    {
      "published_at": "2026-10-14",
      "title": "Bulletin de s\u00e9curit\u00e9 F5 K000162613",
      "url": "https://my.f5.com/manage/s/article/K000162613"
    },
    {
      "published_at": "2026-10-14",
      "title": "Bulletin de s\u00e9curit\u00e9 F5 K000162606",
      "url": "https://my.f5.com/manage/s/article/K000162606"
    },
    {
      "published_at": "2026-10-14",
      "title": "Bulletin de s\u00e9curit\u00e9 F5 K000162416",
      "url": "https://my.f5.com/manage/s/article/K000162416"
    },
    {
      "published_at": "2026-10-14",
      "title": "Bulletin de s\u00e9curit\u00e9 F5 K000162607",
      "url": "https://my.f5.com/manage/s/article/K000162607"
    },
    {
      "published_at": "2026-10-14",
      "title": "Bulletin de s\u00e9curit\u00e9 F5 K000162608",
      "url": "https://my.f5.com/manage/s/article/K000162608"
    }
  ]
}

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "NGINX Open Source versions ant\u00e9rieures \u00e0 1.30.5",
      "product": {
        "name": "NGINX",
        "vendor": {
          "name": "F5",
          "scada": false
        }
      }
    },
    {
      "description": "NGINX Open Source versions 1.31.x ant\u00e9rieures \u00e0 1.31.6",
      "product": {
        "name": "NGINX",
        "vendor": {
          "name": "F5",
          "scada": false
        }
      }
    },
    {
      "description": "NGINX Plus versions 37.x ant\u00e9rieures \u00e0 37.0.6.2",
      "product": {
        "name": "NGINX Plus",
        "vendor": {
          "name": "F5",
          "scada": false
        }
      }
    },
    {
      "description": "NGINX Plus versions 37.1.x ant\u00e9rieures \u00e0 37.1.1.2",
      "product": {
        "name": "NGINX Plus",
        "vendor": {
          "name": "F5",
          "scada": false
        }
      }
    },
    {
      "description": "NGINX Ingress Controller versions ant\u00e9rieures \u00e0 5.6.3",
      "product": {
        "name": "NGINX Ingress Controller",
        "vendor": {
          "name": "F5",
          "scada": false
        }
      }
    },
    {
      "description": "NGINX Gateway Fabric versions 2.x ant\u00e9rieures \u00e0 2.7.2",
      "product": {
        "name": "NGINX Gateway Fabric",
        "vendor": {
          "name": "F5",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": "",
  "content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
  "cves": [
    {
      "name": "CVE-2026-90439",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-90439"
    }
  ],
  "initial_release_date": "2026-09-16T00:00:00",
  "last_revision_date": "2026-09-17T00:00:00",
  "links": [],
  "reference": "CERTFR-2026-AVI-1182",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2026-09-16T00:00:00.000000"
    },
    {
      "description": "Ajouts de syst\u00e8mes affect\u00e9s suppl\u00e9mentaires pour refl\u00e9ter la mise \u00e0 jour du bulletin de l\u0027\u00e9diteur.",
      "revision_date": "2026-09-17T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "D\u00e9ni de service \u00e0 distance"
    },
    {
      "description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
    }
  ],
  "summary": "Une vuln\u00e9rabilit\u00e9 a \u00e9t\u00e9 d\u00e9couverte dans F5 NGINX. Elle permet \u00e0 un attaquant de provoquer un d\u00e9ni de service \u00e0 distance et une atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es.",
  "title": "Vuln\u00e9rabilit\u00e9 dans F5 NGINX",
  "vendor_advisories": [
    {
      "published_at": "2026-09-15",
      "title": "Bulletin de s\u00e9curit\u00e9 F5 K000162604",
      "url": "https://my.f5.com/manage/s/article/K000162604"
    }
  ]
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-96615",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-15T15:53:16.545024Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-15T16:43:46.898Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "modules": [
            "NGF"
          ],
          "product": "NGINX Gateway Fabric",
          "vendor": "F5",
          "versions": [
            {
              "lessThan": "2.8.0",
              "status": "affected",
              "version": "2.0.0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "F5 acknowledges Elias Hasas (GitHub: @zer0d4y5) for bringing this issue to our attention and following the highest standards of coordinated disclosure."
        }
      ],
      "datePublic": "2023-01-01T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Description\u003cbr\u003eNGINX Gateway Fabric has a vulnerability when it is configured with Gateway \n\nCustom Resource Definition (CRD) and have an authenticated gRPC connection with NGINX Agent. A\u0026nbsp;namespaced \n\n authenticated attacker with access to a service account may impersonate the authenticated\u0026nbsp;NGINX Agent gRPC connection to read\u0026nbsp;TLS private keys of Gateway deployments in another namespace.\u0026nbsp;\u003cbr\u003e\u003cbr\u003eImpact\u003cbr\u003eA remote authenticated attacker may be able to\u0026nbsp;read TLS private keys of Gateway deployments in another namespace.\u0026nbsp;\n\nThere is no data plane exposure; this is a control plane issue only.\n\n\u003cbr\u003e\u003cbr\u003e\n\n\nNote: Software versions which have reached End of Technical Support (EoTS) are not evaluated."
            }
          ],
          "value": "Description\nNGINX Gateway Fabric has a vulnerability when it is configured with Gateway \n\nCustom Resource Definition (CRD) and have an authenticated gRPC connection with NGINX Agent. A\u00a0namespaced \n\n authenticated attacker with access to a service account may impersonate the authenticated\u00a0NGINX Agent gRPC connection to read\u00a0TLS private keys of Gateway deployments in another namespace.\u00a0\n\nImpact\nA remote authenticated attacker may be able to\u00a0read TLS private keys of Gateway deployments in another namespace.\u00a0\n\nThere is no data plane exposure; this is a control plane issue only.\n\n\n\n\n\n\nNote: Software versions which have reached End of Technical Support (EoTS) are not evaluated."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-151",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-151 Identity Spoofing"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        },
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-290",
              "description": "CWE-290 Authentication Bypass by Spoofing",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-14T14:40:28.213Z",
        "orgId": "9dacffd4-cb11-413f-8451-fbbfd4ddc0ab",
        "shortName": "f5"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://my.f5.com/manage/s/article/K000162610"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "NGINX Gateway Fabric vulnerability",
      "workarounds": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "None"
            }
          ],
          "value": "None"
        }
      ],
      "x_generator": {
        "engine": "F5 SIRTBot v1.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "9dacffd4-cb11-413f-8451-fbbfd4ddc0ab",
    "assignerShortName": "f5",
    "cveId": "CVE-2026-96615",
    "datePublished": "2026-10-14T14:40:28.213Z",
    "dateReserved": "2026-09-30T21:56:14.616Z",
    "dateUpdated": "2026-10-15T16:43:46.898Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-91184",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-15T03:57:02.149250Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-15T10:31:15.425Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "modules": [
            "NGF"
          ],
          "product": "NGINX Gateway Fabric",
          "vendor": "F5",
          "versions": [
            {
              "lessThan": "2.8.0",
              "status": "affected",
              "version": "2.4.0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "F5 acknowledges apvxlab (AppViewX security research) for bringing this issue to our attention and following the highest standards of coordinated disclosure."
        }
      ],
      "datePublic": "2023-01-01T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Description\u003cbr\u003e\u003cbr\u003eNGINX Gateway Fabric\u0026nbsp;has a vulnerability when it renders the spec.basic.realm (and spec.jwt.realm) field of a namespaced AuthenticationFilter verbatim, unescaped and unvalidated, into the shared data-plane nginx.conf as auth_basic \"\u0026lt;realm\u0026gt;\";. A namespaced authenticated attacker that configures AuthenticationFilter CRD to an HTTPRoute/GRPCRoute on a shared Gateway can craft a realm value that closes the quoted directive and the enclosing location {} block and injects arbitrary NGINX directives into that Gateway\u0027s data-plane config.\u0026nbsp;\u003cbr\u003e\u003cbr\u003eImpact\u003cbr\u003e\u003cbr\u003eA remote authenticated attacker can send crafted requests to configure NGINX Gateway Fabric\u0026nbsp;AuthenticationFilter CRD and\u0026nbsp;may be able to read every co-located tenant\u0027s mounted secrets, SSRF via proxy_pass, reading the pod ServiceAccount token, or hijacking other tenants\u0027 routes.\u0026nbsp;\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eThere is no data plane exposure; this is a control plane issue only.\u003c/span\u003e\n\n\u003cbr\u003e\u003cbr\u003e\n\n\nNote: Software versions which have reached End of Technical Support (EoTS) are not evaluated."
            }
          ],
          "value": "Description\n\nNGINX Gateway Fabric\u00a0has a vulnerability when it renders the spec.basic.realm (and spec.jwt.realm) field of a namespaced AuthenticationFilter verbatim, unescaped and unvalidated, into the shared data-plane nginx.conf as auth_basic \"\u003crealm\u003e\";. A namespaced authenticated attacker that configures AuthenticationFilter CRD to an HTTPRoute/GRPCRoute on a shared Gateway can craft a realm value that closes the quoted directive and the enclosing location {} block and injects arbitrary NGINX directives into that Gateway\u0027s data-plane config.\u00a0\n\nImpact\n\nA remote authenticated attacker can send crafted requests to configure NGINX Gateway Fabric\u00a0AuthenticationFilter CRD and\u00a0may be able to read every co-located tenant\u0027s mounted secrets, SSRF via proxy_pass, reading the pod ServiceAccount token, or hijacking other tenants\u0027 routes.\u00a0There is no data plane exposure; this is a control plane issue only.\n\n\n\n\n\n\nNote: Software versions which have reached End of Technical Support (EoTS) are not evaluated."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-3",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-3 Using Leading \u0027Ghost\u0027 Character Sequences to Bypass Input Filters"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        },
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-76",
              "description": "CWE-76",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-14T14:40:27.849Z",
        "orgId": "9dacffd4-cb11-413f-8451-fbbfd4ddc0ab",
        "shortName": "f5"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://my.f5.com/manage/s/article/K000162609"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "NGINX Gateway Fabric vulnerability",
      "workarounds": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003e\n\n\u003cdiv\u003e\u003cp\u003eAs this attack is conducted by authenticated users with Kubernetes Role-based Access Control (RBAC) write access to AuthenticationFilter\u0026nbsp;\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eCRD\u003c/span\u003e\u0026nbsp;and Secrets, the only complete mitigation is to restrict that access to fully trusted administrators only.\u003c/p\u003e\u003c/div\u003e\u003c/span\u003e"
            }
          ],
          "value": "As this attack is conducted by authenticated users with Kubernetes Role-based Access Control (RBAC) write access to AuthenticationFilter\u00a0CRD\u00a0and Secrets, the only complete mitigation is to restrict that access to fully trusted administrators only."
        }
      ],
      "x_generator": {
        "engine": "F5 SIRTBot v1.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "9dacffd4-cb11-413f-8451-fbbfd4ddc0ab",
    "assignerShortName": "f5",
    "cveId": "CVE-2026-91184",
    "datePublished": "2026-10-14T14:40:27.849Z",
    "dateReserved": "2026-09-30T21:56:14.612Z",
    "dateUpdated": "2026-10-15T10:31:15.425Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-66362",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-02T00:00:00+00:00",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-03T03:56:36.276Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "modules": [
            "configuration generator component"
          ],
          "product": "NGINX Gateway Fabric",
          "vendor": "F5",
          "versions": [
            {
              "lessThan": "2.6.8",
              "status": "affected",
              "version": "2.5.0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "F5 acknowledges Rushit Palesha (GitHub: rushitgit) and Sujal Tuladhar (EvilGenius) for bringing this issue to our attention and following the highest standards of coordinated disclosure."
        }
      ],
      "datePublic": "2023-01-01T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eDescription:\u003cbr\u003eWhen NGINX Plus is configured as the data plane for NGINX Gateway Fabric, an injection vulnerability exists in the NGINX configuration generator component of NGINX Gateway Fabric. User-supplied string values from the Authentication Filter Custom Resource Definition clientID or cookieName fields, or in the clientSecret field of a Secret referenced by an Authentication Filter, are rendered directly into NGINX configuration templates without sanitization or escaping. \u003cbr\u003e\u003cbr\u003eImpact:\u003cbr\u003eAn authenticated attacker with permission to create or modify these resources may craft values that inject arbitrary NGINX configuration directives. This is a control plane issue; there is no data plane exposure.\u003c/span\u003e\u003cbr\u003e"
            }
          ],
          "value": "Description:\nWhen NGINX Plus is configured as the data plane for NGINX Gateway Fabric, an injection vulnerability exists in the NGINX configuration generator component of NGINX Gateway Fabric. User-supplied string values from the Authentication Filter Custom Resource Definition clientID or cookieName fields, or in the clientSecret field of a Secret referenced by an Authentication Filter, are rendered directly into NGINX configuration templates without sanitization or escaping. \n\nImpact:\nAn authenticated attacker with permission to create or modify these resources may craft values that inject arbitrary NGINX configuration directives. This is a control plane issue; there is no data plane exposure."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        },
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.6,
            "baseSeverity": "HIGH",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-76",
              "description": "CWE-76",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-02T15:40:54.441Z",
        "orgId": "9dacffd4-cb11-413f-8451-fbbfd4ddc0ab",
        "shortName": "f5"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://my.f5.com/manage/s/article/K000162600"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "NGF vulnerability",
      "workarounds": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003e\n\n\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eAs this attack is conducted by authenticated users with Kubernetes role-based access control (RBAC) write access to the affected CRDs, the only complete mitigation is to restrict that access to fully trusted administrators only.\u003c/span\u003e\n\n\u003c/span\u003e"
            }
          ],
          "value": "As this attack is conducted by authenticated users with Kubernetes role-based access control (RBAC) write access to the affected CRDs, the only complete mitigation is to restrict that access to fully trusted administrators only."
        }
      ],
      "x_generator": {
        "engine": "F5 SIRTBot v1.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "9dacffd4-cb11-413f-8451-fbbfd4ddc0ab",
    "assignerShortName": "f5",
    "cveId": "CVE-2026-66362",
    "datePublished": "2026-09-02T15:40:54.441Z",
    "dateReserved": "2026-07-30T21:15:36.935Z",
    "dateUpdated": "2026-09-03T03:56:36.276Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-32682",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-18T12:57:19.705230Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-18T12:57:26.063Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "modules": [
            "GRPCRoutes"
          ],
          "product": "NGINX Gateway Fabric",
          "vendor": "F5",
          "versions": [
            {
              "lessThan": "2.6.4",
              "status": "affected",
              "version": "1.3.0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "F5"
        }
      ],
      "datePublic": "2026-06-17T14:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eWhen NGINX Gateway Fabric is configured using GRPCRoutes, an authenticated, remote attacker with permission to create or modify GRPCRoute resources can cause the NGINX Gateway Fabric control plane to terminate by sending undisclosed GRPCRoute configurations containing backendRef filters.\u003c/span\u003e \n\n\nNote: Software versions which have reached End of Technical Support (EoTS) are not evaluated."
            }
          ],
          "value": "When NGINX Gateway Fabric is configured using GRPCRoutes, an authenticated, remote attacker with permission to create or modify GRPCRoute resources can cause the NGINX Gateway Fabric control plane to terminate by sending undisclosed GRPCRoute configurations containing backendRef filters. \n\n\nNote: Software versions which have reached End of Technical Support (EoTS) are not evaluated."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        },
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-129",
              "description": "CWE-129 Improper Validation of Array Index",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-17T20:05:17.808Z",
        "orgId": "9dacffd4-cb11-413f-8451-fbbfd4ddc0ab",
        "shortName": "f5"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://my.f5.com/manage/s/article/K000161786"
        }
      ],
      "source": {
        "discovery": "INTERNAL"
      },
      "title": "NGINX Gateway Fabric vulnerability",
      "x_generator": {
        "engine": "F5 SIRTBot v1.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "9dacffd4-cb11-413f-8451-fbbfd4ddc0ab",
    "assignerShortName": "f5",
    "cveId": "CVE-2026-32682",
    "datePublished": "2026-06-17T20:05:17.808Z",
    "dateReserved": "2026-06-17T16:35:56.342Z",
    "dateUpdated": "2026-06-18T12:57:26.063Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-50107",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-18T12:57:49.527832Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-18T12:57:56.612Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "modules": [
            "Custom Resource Definitions"
          ],
          "product": "NGINX Gateway Fabric",
          "vendor": "F5",
          "versions": [
            {
              "lessThan": "2.6.4",
              "status": "affected",
              "version": "2.3.0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "F5"
        }
      ],
      "datePublic": "2026-06-17T14:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eWhen NGINX Plus or NGINX Open Source is configured as the data plane for NGINX Gateway Fabric, an injection vulnerability exists in the NGINX configuration generator component of NGINX Gateway Fabric. User-supplied string values from the \u003c/span\u003e\u003cstrong\u003eNginxProxy\u003c/strong\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003e\u0026nbsp;Custom Resource Definition (CRD) access log format setting are rendered directly into NGINX configuration templates without sanitization or escaping. An authenticated attacker with permission to create or modify these CRDs may craft values that inject arbitrary NGINX configuration directives. This is a control plane issue; there is no data plane exposure from the vulnerability trigger itself.\u003c/span\u003e \n\n\nNote: Software versions which have reached End of Technical Support (EoTS) are not evaluated."
            }
          ],
          "value": "When NGINX Plus or NGINX Open Source is configured as the data plane for NGINX Gateway Fabric, an injection vulnerability exists in the NGINX configuration generator component of NGINX Gateway Fabric. User-supplied string values from the NginxProxy\u00a0Custom Resource Definition (CRD) access log format setting are rendered directly into NGINX configuration templates without sanitization or escaping. An authenticated attacker with permission to create or modify these CRDs may craft values that inject arbitrary NGINX configuration directives. This is a control plane issue; there is no data plane exposure from the vulnerability trigger itself. \n\n\nNote: Software versions which have reached End of Technical Support (EoTS) are not evaluated."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        },
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.6,
            "baseSeverity": "HIGH",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-74",
              "description": "CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component (\u0027Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-17T20:04:44.518Z",
        "orgId": "9dacffd4-cb11-413f-8451-fbbfd4ddc0ab",
        "shortName": "f5"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://my.f5.com/manage/s/article/K000161785"
        }
      ],
      "source": {
        "discovery": "INTERNAL"
      },
      "title": "NGINX Gateway Fabric vulnerability",
      "x_generator": {
        "engine": "F5 SIRTBot v1.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "9dacffd4-cb11-413f-8451-fbbfd4ddc0ab",
    "assignerShortName": "f5",
    "cveId": "CVE-2026-50107",
    "datePublished": "2026-06-17T20:04:44.518Z",
    "dateReserved": "2026-06-17T16:35:56.336Z",
    "dateUpdated": "2026-06-18T12:57:56.612Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-11311",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-17T15:42:03.715663Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-17T15:42:37.296Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "modules": [
            "Custom Resource Definitions"
          ],
          "product": "NGINX Gateway Fabric",
          "vendor": "F5",
          "versions": [
            {
              "lessThan": "2.6.4",
              "status": "affected",
              "version": "2.5.0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "F5"
        }
      ],
      "datePublic": "2026-06-17T14:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eWhen NGINX Plus is configured as the data plane for NGINX Gateway Fabric, an injection vulnerability exists in the NGINX configuration generator component of NGINX Gateway Fabric. User-supplied string values from the \u003c/span\u003e\u003cstrong\u003eNginxProxy\u003c/strong\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003e\u0026nbsp;Custom Resource Definition \u003c/span\u003e\u003cstrong\u003eserverTokens\u003c/strong\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003e\u0026nbsp;field and the \u003c/span\u003e\u003cstrong\u003eAuthenticationFilter\u003c/strong\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003e\u0026nbsp;Custom Resource Definition \u003c/span\u003e\u003cstrong\u003eextraAuthArgs\u003c/strong\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003e\u0026nbsp;field are rendered directly into NGINX configuration templates without sanitization or escaping. An authenticated attacker with permission to create or modify these Custom Resource Definitions may craft values that inject arbitrary NGINX configuration directives. This is a control plane issue; there is no data plane exposure from the vulnerability trigger itself.\u003c/span\u003e \n\n\nNote: Software versions which have reached End of Technical Support (EoTS) are not evaluated."
            }
          ],
          "value": "When NGINX Plus is configured as the data plane for NGINX Gateway Fabric, an injection vulnerability exists in the NGINX configuration generator component of NGINX Gateway Fabric. User-supplied string values from the NginxProxy\u00a0Custom Resource Definition serverTokens\u00a0field and the AuthenticationFilter\u00a0Custom Resource Definition extraAuthArgs\u00a0field are rendered directly into NGINX configuration templates without sanitization or escaping. An authenticated attacker with permission to create or modify these Custom Resource Definitions may craft values that inject arbitrary NGINX configuration directives. This is a control plane issue; there is no data plane exposure from the vulnerability trigger itself. \n\n\nNote: Software versions which have reached End of Technical Support (EoTS) are not evaluated."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        },
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.6,
            "baseSeverity": "HIGH",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-76",
              "description": "CWE-76 Improper Neutralization of Equvalent Special Elements",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-17T14:04:33.197Z",
        "orgId": "9dacffd4-cb11-413f-8451-fbbfd4ddc0ab",
        "shortName": "f5"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://my.f5.com/manage/s/article/K000161611"
        }
      ],
      "source": {
        "discovery": "INTERNAL"
      },
      "tags": [
        "x_F5"
      ],
      "title": "NGINX Gateway Fabric vulnerability",
      "x_generator": {
        "engine": "F5 SIRTBot v1.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "9dacffd4-cb11-413f-8451-fbbfd4ddc0ab",
    "assignerShortName": "f5",
    "cveId": "CVE-2026-11311",
    "datePublished": "2026-06-17T14:04:33.197Z",
    "dateReserved": "2026-06-04T18:01:54.825Z",
    "dateUpdated": "2026-06-17T15:42:37.296Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}