CVE-2026-32682: NGINX Gateway Fabric DoS Vulnerability

CVE-2026-32682 Overview

CVE-2026-32682 affects NGINX Gateway Fabric deployments configured with GRPCRoutes. An authenticated remote attacker holding permission to create or modify GRPCRoute resources can terminate the NGINX Gateway Fabric control plane. The attacker triggers the condition by submitting GRPCRoute configurations containing crafted backendRef filters. The flaw is tracked under CWE-129: Improper Validation of Array Index and disrupts traffic routing across the cluster. Software versions that have reached End of Technical Support (EoTS) were not evaluated by the vendor.

Critical Impact
A single authenticated user with GRPCRoute write access can crash the NGINX Gateway Fabric control plane, breaking gRPC traffic management for every workload behind the gateway.

Affected Products

NGINX Gateway Fabric (versions documented in the F5 advisory)
Kubernetes clusters using NGINX Gateway Fabric with GRPCRoute resources
Deployments relying on backendRef filters for gRPC traffic routing

Discovery Timeline

2026-06-17 - CVE-2026-32682 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2026-32682

Vulnerability Analysis

NGINX Gateway Fabric is the F5 implementation of the Kubernetes Gateway API. It uses Custom Resources such as GRPCRoute to define how gRPC traffic is routed to backend services. The control plane watches these resources and translates them into NGINX configuration.

When a GRPCRoute resource contains specific backendRef filters, the control plane fails to validate input boundaries correctly. Processing the malformed configuration causes the control plane process to terminate. Because the control plane is the component that reconciles routing state, its termination halts configuration updates and can interrupt gRPC traffic management cluster-wide.

The weakness maps to CWE-129: Improper Validation of Array Index, indicating that an index derived from attacker-controlled input is used without sufficient bounds checking.

Root Cause

The root cause is missing or insufficient validation of fields inside GRPCRoute.spec.rules[].backendRefs[].filters. The control plane consumes those filters and dereferences indexed structures without enforcing safe bounds, leading to an unrecoverable error and process termination.

Attack Vector

Exploitation requires network access to the Kubernetes API server and authenticated credentials with Role-Based Access Control (RBAC) rights to create or modify GRPCRoute resources in any namespace consumed by the gateway. The attacker submits a crafted GRPCRoute manifest through kubectl apply or the Kubernetes API. The control plane ingests the resource, hits the unvalidated index path, and exits. Refer to the F5 Knowledge Base Article K000161786 for the vendor's technical write-up.

No public proof-of-concept is available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2026-32682

Indicators of Compromise

Unexpected restarts or CrashLoopBackOff status on NGINX Gateway Fabric control plane pods
Audit log entries showing create or update actions on GRPCRoute resources from non-administrative service accounts
Stalled reconciliation events and outdated NGINX configuration after a GRPCRoute change
Gaps in gRPC traffic metrics correlated with GRPCRoute manifest submissions

Detection Strategies

Monitor the Kubernetes audit log for grpcroutes.gateway.networking.k8s.io write operations, especially those including backendRefs with filters.
Alert on NGINX Gateway Fabric controller pod restarts and non-zero exit codes within short time windows.
Correlate GRPCRoute modifications with controller termination events to identify the triggering manifest.

Monitoring Recommendations

Track control plane liveness probes and container restart counts using Prometheus or an equivalent metrics pipeline.
Ingest Kubernetes audit logs into a centralized SIEM or data lake and build identifications for high-frequency GRPCRoute changes per user or service account.
Watch for RBAC bindings that grant grpcroutes write verbs to service accounts outside the platform team.

How to Mitigate CVE-2026-32682

Immediate Actions Required

Apply the fixed NGINX Gateway Fabric release listed in F5 Knowledge Base Article K000161786.
Audit RBAC permissions and remove create, update, and patch verbs on grpcroutes.gateway.networking.k8s.io from any subject that does not require them.
Inventory existing GRPCRoute resources and verify the contents of every backendRefs[].filters block.

Patch Information

F5 has published remediation guidance and fixed versions in Knowledge Base Article K000161786. Versions that have reached End of Technical Support are not evaluated and should be upgraded to a supported release. Confirm the deployed nginx-gateway-fabric image tag matches a patched build after upgrade.

Workarounds

Disable GRPCRoute usage and route gRPC traffic through HTTPRoute resources until the patch is applied.
Apply a validating admission policy or OPA Gatekeeper constraint that rejects GRPCRoute resources containing backendRef filters.
Restrict GRPCRoute write access to a small set of trusted operators using namespaced RBAC roles.
Run multiple replicas of the NGINX Gateway Fabric control plane to shorten recovery time after a crash, while keeping in mind that a malicious manifest will still terminate replicas processing it.

bash

# Restrict GRPCRoute write access to a dedicated group
kubectl create clusterrole grpcroute-editor \
  --verb=get,list,watch,create,update,patch,delete \
  --resource=grpcroutes.gateway.networking.k8s.io

kubectl create clusterrolebinding grpcroute-editor-binding \
  --clusterrole=grpcroute-editor \
  --group=platform-network-admins

# Identify subjects currently allowed to modify GRPCRoutes
kubectl auth can-i update grpcroutes.gateway.networking.k8s.io \
  --all-namespaces --list