Read the docs
TI-2026-74061 Aliases CVE-2026-96615GHSA-h8jf-9855-344m

Authentication bypass in NGINX Gateway Fabric exposes TLS private keys

Priority LOW 31CWE-290Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Security bypass
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-290.

Summary

F5 NGINX Gateway Fabric from 2.0.0 before 2.8.0 is affected when configured with the Gateway Custom Resource Definition (CRD). A namespaced attacker with access to a service account can impersonate an authenticated NGINX Agent gRPC connection, which is a spoofing flaw (CWE-290). An authenticated remote attacker can read TLS private keys of Gateway deployments in another namespace. The issue affects only the control plane, with no data plane exposure.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

Description NGINX Gateway Fabric has a vulnerability when it is configured with Gateway Custom Resource Definition (CRD) and have an authenticated gRPC connection with NGINX Agent. A namespaced authenticated attacker with access to a service account may impersonate the authenticated NGINX Agent gRPC connection to read TLS private keys of Gateway deployments in another namespace.  Impact A remote authenticated attacker may be able to read TLS private keys of Gateway deployments in another namespace.  There is no data plane exposure; this is a control plane issue only. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00256 17th percentileScored 2026-11-07
Fix Fixed NGINX Gateway Fabric (F5): 2.8.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
F5NGINX Gateway Fabric2.0.0 to before 2.8.02.8.0Patch availableCNA
  • NGINX Gateway Fabric VendorF5 Affected 2.0.0 to before 2.8.0 Fixed in 2.8.0 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:f5:nginx_gateway_fabric:*:*:*:*:*:*:*:*——F5
  • cpe:2.3:a:f5:nginx_gateway_fabric:*:*:*:*:*:*:*:* Versions — — ·F5

Remediation

Upgrade F5 NGINX Gateway Fabric to version 2.8.0 or later, which is the fixed version.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

  • Fix · CNA NGINX Gateway Fabric (F5) Fixed in 2.8.0

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    F5 NGINX Gateway Fabric 2.8.0

    2 records Highest priority Priority MEDIUM 1 MEDIUM, 1 LOW

    Other records, highest priority first

    • TI-2026-74052 Configuration injection in NGINX Gateway Fabric via AuthenticationFilterPriority MEDIUM 40
    Show all 2 records →

Timeline

  1. 2026-10-14 Threatist record created from CVE-2026-96615
  2. 2026-10-14 Alias added: GHSA-h8jf-9855-344m
  3. 2026-10-16 CISA SSVC decision points changed
  4. 2026-10-16 Priority changed: MEDIUM → LOW

References

Advisory 1

  • TI-2023-25230 BIG-IP Configuration utility unauthenticated remote code execution vulnerability KEVCVSS 3.1CRITICAL 9.8
  • TI-2022-01269 Missing authentication in F5 BIG-IP KEVCVSS 3.1CRITICAL 9.8
  • TI-2021-05850 Memory corruption in BIG-IP KEVCVSS 3.1CRITICAL 9.8
  • TI-2021-05845 Server-side request forgery in BIG-IP; BIG-IQ KEVCVSS 3.1CRITICAL 9.8
  • TI-2020-04820 Path traversal in BIG-IP KEVCVSS 3.1CRITICAL 9.8
  • TI-2014-05975 GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed… KEVCVSS 3.1CRITICAL 9.8
See all 1057 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences