Read the docs
TI-2026-74058 Aliases CVE-2026-94197GHSA-5m5m-935w-8wj6

Authentication bypass in F5 NGINX Ingress Controller via spoofed headers

Priority MEDIUM 44CWE-290Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Security bypass
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-290.

Summary

F5 NGINX Ingress Controller (NIC) from 5.5.0 before 5.7.0 is affected when configured with the ExternalAuth policy or Ingress external authentication. Client-supplied X-Forwarded-Prefix, X-Forwarded-URI, X-Original-URI and X-Forwarded-Method headers are passed unsanitized into the internal authentication subrequest, a flaw classified as CWE-290. An unauthenticated remote attacker can spoof request attributes evaluated by the external authentication provider and gain access to protected paths.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

An authentication and authorization bypass vulnerability exists in F5 NGINX Kubernetes Ingress Controller (NIC) when configured with the `ExternalAuth` policy or Ingress external authentication. Client-supplied X-Forwarded-Prefix, X-Forwarded-URI, X-Original-URI, and X-Forwarded-Method routing and method headers are forwarded unsanitized into the internal authentication subrequest (handled by the NGINX auth_request directive). As a result, an unauthenticated, remote attacker may spoof request attributes evaluated by the external authentication provider. Impact: This vulnerability may allow remote attackers unauthenticated access to protected paths. There is no control plane exposure; this is a data plane issue only. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00394 33rd percentileScored 2026-11-07
Fix Fixed NGINX Ingress Controller (F5): 5.7.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
F5NGINX Ingress Controller5.5.0 to before 5.7.05.7.0Patch availableCNA
  • NGINX Ingress Controller VendorF5 Affected 5.5.0 to before 5.7.0 Fixed in 5.7.0 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:f5:nginx_ingress_controller:*:*:*:*:*:*:*:*——F5
  • cpe:2.3:a:f5:nginx_ingress_controller:*:*:*:*:*:*:*:* Versions — — ·F5

Remediation

Upgrade F5 NGINX Ingress Controller to version 5.7.0 or later. The sources list no other fixed version for NGINX Ingress Controller.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

  • Fix · CNA NGINX Ingress Controller (F5) Fixed in 5.7.0

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    F5 NGINX Ingress Controller 5.7.0

    2 records Highest priority Priority MEDIUM 2 MEDIUM

    Other records, highest priority first

    • TI-2026-74074 NGINX Ingress Controller externalAuth flaw exposes protected pathsPriority MEDIUM 44
    Show all 2 records →

Timeline

  1. 2026-10-14 Threatist record created from CVE-2026-94197
  2. 2026-10-14 Alias added: GHSA-5m5m-935w-8wj6
  3. 2026-10-16 CISA SSVC decision points changed

References

Advisory 1

  • TI-2023-25230 BIG-IP Configuration utility unauthenticated remote code execution vulnerability KEVCVSS 3.1CRITICAL 9.8
  • TI-2022-01269 Missing authentication in F5 BIG-IP KEVCVSS 3.1CRITICAL 9.8
  • TI-2021-05850 Memory corruption in BIG-IP KEVCVSS 3.1CRITICAL 9.8
  • TI-2021-05845 Server-side request forgery in BIG-IP; BIG-IQ KEVCVSS 3.1CRITICAL 9.8
  • TI-2020-04820 Path traversal in BIG-IP KEVCVSS 3.1CRITICAL 9.8
  • TI-2014-05975 GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed… KEVCVSS 3.1CRITICAL 9.8
See all 1057 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences