Read the docs
TI-2026-74074 Aliases CVE-2026-104939GHSA-qcp7-h72p-6whw

NGINX Ingress Controller externalAuth flaw exposes protected paths

Priority MEDIUM 44CWE-303Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

F5 NGINX Ingress Controller from 5.6.0 before 5.7.0 is affected when an externalAuth policy is configured for an ingress. The controller may mishandle the HTTP response from an OAuth identity provider, a flaw classified as CWE-303, Incorrect Implementation of Authentication Algorithm. A remote attacker without credentials can reach protected paths before external authentication completes. Only the data plane is affected; the control plane is not exposed.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

Description NGINX Ingress Controller has a vulnerability when implementing an externalAuth policy for ingress. NGINX Ingress Controller may mishandle the HTTP response from an OAuth IdP and allow an attacker to acquire unauthenticated access to protected paths before the proper external authentication can happen. Impact This vulnerability may allow remote attackers unauthenticated access to protected paths. There is no control plane exposure; this is a data plane issue only. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00377 31st percentileScored 2026-11-07
Fix Fixed NGINX Ingress Controller (F5): 5.7.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
F5NGINX Ingress Controller5.6.0 to before 5.7.05.7.0Patch availableCNA
  • NGINX Ingress Controller VendorF5 Affected 5.6.0 to before 5.7.0 Fixed in 5.7.0 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:f5:nginx_ingress_controller:*:*:*:*:*:*:*:*——F5
  • cpe:2.3:a:f5:nginx_ingress_controller:*:*:*:*:*:*:*:* Versions — — ·F5

Remediation

Upgrade F5 NGINX Ingress Controller to version 5.7.0 or later. Versions before 5.6.0 fall outside the listed affected range, and the sources give no fixed version for them. Versions that have reached End of Technical Support are not evaluated.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

  • Fix · CNA NGINX Ingress Controller (F5) Fixed in 5.7.0

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    F5 NGINX Ingress Controller 5.7.0

    2 records Highest priority Priority MEDIUM 2 MEDIUM

    Other records, highest priority first

    • TI-2026-74058 Authentication bypass in F5 NGINX Ingress Controller via spoofed headersPriority MEDIUM 44
    Show all 2 records →

Timeline

  1. 2026-10-14 Threatist record created from CVE-2026-104939
  2. 2026-10-14 Alias added: GHSA-qcp7-h72p-6whw
  3. 2026-10-16 CISA SSVC decision points changed

References

Advisory 1

  • TI-2023-25230 BIG-IP Configuration utility unauthenticated remote code execution vulnerability KEVCVSS 3.1CRITICAL 9.8
  • TI-2022-01269 Missing authentication in F5 BIG-IP KEVCVSS 3.1CRITICAL 9.8
  • TI-2021-05850 Memory corruption in BIG-IP KEVCVSS 3.1CRITICAL 9.8
  • TI-2021-05845 Server-side request forgery in BIG-IP; BIG-IQ KEVCVSS 3.1CRITICAL 9.8
  • TI-2020-04820 Path traversal in BIG-IP KEVCVSS 3.1CRITICAL 9.8
  • TI-2014-05975 GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed… KEVCVSS 3.1CRITICAL 9.8
See all 1057 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences