CVE-2026-22549: F5 BIG-IP Info Disclosure Vulnerability

CVE-2026-22549 Overview

A privilege escalation vulnerability exists in F5 BIG-IP Container Ingress Services that may allow excessive permissions to read cluster secrets. This vulnerability stems from improper access control (CWE-250: Execution with Unnecessary Privileges), where the affected component operates with more privileges than required, potentially exposing sensitive Kubernetes cluster secrets to unauthorized access.

Critical Impact

Attackers with high-privilege network access could exploit this vulnerability to read sensitive cluster secrets, potentially exposing credentials, API keys, certificates, and other confidential data stored within the Kubernetes environment.

Affected Products

• F5 BIG-IP Container Ingress Services (versions not yet at End of Technical Support)

Discovery Timeline

• 2026-02-04 - CVE CVE-2026-22549 published to NVD
• 2026-02-04 - Last updated in NVD database

Technical Details for CVE-2026-22549

Vulnerability Analysis

This vulnerability affects F5 BIG-IP Container Ingress Services, a component that manages traffic routing and load balancing for containerized applications in Kubernetes environments. The flaw allows the service to operate with excessive permissions, enabling it to read cluster secrets beyond what is necessary for its intended function.

The vulnerability is categorized under CWE-250 (Execution with Unnecessary Privileges), indicating that the affected software runs with more permissions than required for normal operation. In Kubernetes environments, this type of misconfiguration can be particularly dangerous as cluster secrets often contain sensitive information such as database credentials, API tokens, TLS certificates, and service account keys.

The attack requires network access and high privileges (authenticated access), but once exploited, it enables read access to confidential data without any user interaction required.

Root Cause

The root cause of this vulnerability lies in the overly permissive Role-Based Access Control (RBAC) configuration assigned to the BIG-IP Container Ingress Services component. The service's ServiceAccount or ClusterRole is granted broader secret-reading permissions than necessary for its legitimate functionality, violating the principle of least privilege. This excessive permission grant allows the service—and potentially any attacker who compromises it—to enumerate and read secrets across the Kubernetes cluster or namespace.

Attack Vector

The vulnerability is exploitable over the network by an authenticated attacker with high privileges. An attacker who gains access to the BIG-IP Container Ingress Services component, or can manipulate its operations, could leverage the excessive permissions to read Kubernetes secrets that should be inaccessible.

The attack flow involves:

1. Gaining authenticated access to the affected BIG-IP Container Ingress Services environment
2. Leveraging the service's excessive RBAC permissions to query the Kubernetes API
3. Reading cluster secrets containing sensitive credentials and configuration data
4. Using the extracted secrets for lateral movement or further compromise

For detailed technical information, refer to the F5 Security Article K000157960.

Detection Methods for CVE-2026-22549

Indicators of Compromise

• Unusual API calls to the Kubernetes Secrets API from the BIG-IP Container Ingress Services pod or service account
• Audit log entries showing secret enumeration or read operations beyond the service's normal behavior
• Unexpected access patterns to secrets outside the expected namespace scope
• Anomalous volume of GET /api/v1/secrets or GET /api/v1/namespaces/*/secrets requests

Detection Strategies

• Enable and monitor Kubernetes audit logs for secret access events attributed to the BIG-IP Container Ingress Services service account
• Implement alerting for any secret read operations outside the expected operational scope
• Deploy runtime security monitoring to detect abnormal process behavior within the CIS pods
• Review RBAC bindings periodically to identify overly permissive configurations

Monitoring Recommendations

• Configure Kubernetes audit policies to log all secret access events at the RequestResponse level
• Set up SIEM alerts for patterns indicating secret enumeration or bulk secret access
• Monitor network traffic from BIG-IP CIS components for unusual API server communication patterns
• Implement periodic RBAC audits using tools like kubectl-who-can to track permission drift

How to Mitigate CVE-2026-22549

Immediate Actions Required

• Review the F5 security advisory and apply vendor-recommended patches or configuration changes
• Audit the RBAC permissions assigned to the BIG-IP Container Ingress Services service account
• Implement network policies to restrict API server access from the CIS pods
• Enable Kubernetes audit logging if not already configured

Patch Information

F5 has published security guidance for this vulnerability. Organizations running affected versions of BIG-IP Container Ingress Services should consult the F5 Security Article K000157960 for specific remediation steps, including any available software updates or configuration changes. Note that software versions which have reached End of Technical Support (EoTS) are not evaluated and may remain vulnerable.

Workarounds

• Restrict the ServiceAccount permissions for BIG-IP CIS to only the specific secrets it requires
• Implement namespace-scoped Roles instead of ClusterRoles where possible to limit secret access scope
• Deploy Kubernetes NetworkPolicies to limit pod-to-API-server communication
• Consider using external secrets management solutions to reduce sensitive data stored in Kubernetes secrets

# Example: Audit current RBAC permissions for the CIS service account
kubectl auth can-i --list --as=system:serviceaccount:kube-system:bigip-ctlr

# Review ClusterRoleBindings associated with the CIS service account
kubectl get clusterrolebindings -o json | jq '.items[] | select(.subjects[]?.name=="bigip-ctlr")'

# Check which secrets the service account can access
kubectl auth can-i get secrets --as=system:serviceaccount:kube-system:bigip-ctlr -A