CVE-2026-60062: NGINX Agent Path Traversal Vulnerability

CVE-2026-60062 Overview

CVE-2026-60062 is a path traversal vulnerability [CWE-22] in the NGINX Agent config_dirs directive. The flaw allows a remotely authenticated, low-privileged attacker to read and write files outside the directories designated as secure. The config_dirs directive can also be configured through NGINX Instance Manager, extending the exposure to managed deployments. Successful exploitation crosses a security boundary defined by the agent's configuration scope.

Critical Impact
A remotely authenticated low-privileged attacker can gain limited read and write access to files outside the directories listed in the NGINX Agent configuration, potentially exposing sensitive configuration data or enabling tampering with adjacent files.

Affected Products

NGINX Agent (versions with config_dirs directive support)
NGINX Instance Manager (when used to configure config_dirs)
Software versions that have reached End of Technical Support (EoTS) were not evaluated

Discovery Timeline

2026-07-15 - CVE-2026-60062 published to the National Vulnerability Database (NVD)
2026-07-15 - Last updated in NVD database

Technical Details for CVE-2026-60062

Vulnerability Analysis

The NGINX Agent enforces a directory allowlist through the config_dirs directive. This allowlist defines the file system paths the agent is authorized to read from and write to when processing configuration operations. The vulnerability allows an authenticated attacker with low privileges to bypass the boundary imposed by this allowlist.

Because the same directive is exposed through NGINX Instance Manager, environments centrally managing multiple NGINX instances inherit the same exposure. The impact is scoped to limited read and write operations, not full arbitrary file access, but the attacker can still reach files the agent was never intended to touch.

The issue is classified under [CWE-22] (Improper Limitation of a Pathname to a Restricted Directory). It requires network access and valid low-privileged credentials, with no user interaction. EPSS data as of 2026-07-19 places exploitation likelihood at 0.197%.

Root Cause

The root cause is insufficient validation of file paths against the config_dirs allowlist. Path components that resolve outside the designated directories are not consistently rejected before file operations are performed. This gap in canonicalization or boundary checking permits traversal past the intended containment.

Attack Vector

An attacker authenticates to the NGINX Agent or to NGINX Instance Manager with a low-privileged account. The attacker then submits configuration or file operation requests that reference paths outside the entries defined in config_dirs. The agent processes these requests and performs limited read or write operations against the out-of-scope paths, delivering the file contents back to the attacker or modifying files under agent-writable ownership.

No verified exploit code has been published for CVE-2026-60062. Refer to F5 Technical Article K000161971 for vendor-provided technical detail.

Detection Methods for CVE-2026-60062

Indicators of Compromise

NGINX Agent log entries referencing file paths outside directories declared in the config_dirs configuration.
Unexpected read or write access timestamps on files adjacent to legitimate NGINX configuration directories.
Authentication events for low-privileged NGINX Agent or NGINX Instance Manager accounts followed by configuration API activity that references absolute or relative paths containing .. sequences.

Detection Strategies

Audit NGINX Agent and Instance Manager API request logs for path parameters that reference locations outside the configured config_dirs entries.
Baseline the expected file access footprint of the NGINX Agent process and alert on file operations that deviate from that baseline.
Correlate low-privileged authentication events with subsequent file system activity performed by the agent's service account.

Monitoring Recommendations

Enable verbose logging on the NGINX Agent for configuration and file operations, and forward logs to a centralized analytics platform.
Monitor file integrity on directories adjacent to those listed in config_dirs, particularly directories containing credentials, keys, or system configuration.
Track changes to the config_dirs directive itself through NGINX Instance Manager audit trails, as unexpected expansions of the allowlist may indicate abuse or misconfiguration.

How to Mitigate CVE-2026-60062

Immediate Actions Required

Review the F5 advisory K000161971 and apply the fixed NGINX Agent version identified by the vendor.
Audit all accounts with access to the NGINX Agent API and NGINX Instance Manager, and revoke unnecessary low-privileged accounts.
Inspect the current config_dirs configuration and reduce the scope to the minimum directories required for operation.

Patch Information

F5 provides remediation guidance in Technical Article K000161971. Software versions that have reached End of Technical Support are not evaluated and will not receive fixes. Operators running EoTS versions should upgrade to a supported release that includes the patch.

Workarounds

Restrict network access to the NGINX Agent management interface to trusted administrative networks only.
Enforce least privilege on NGINX Agent and NGINX Instance Manager accounts, removing configuration write permissions from users who do not require them.
Run the NGINX Agent under a dedicated service account with file system permissions that limit reachable files outside the intended config_dirs scope.

bash

# Configuration example: restrict config_dirs to a single explicit path
# in the NGINX Agent configuration file (nginx-agent.conf)
config_dirs: "/etc/nginx"

# Verify the service account cannot access sensitive paths outside this scope
chown -R nginx-agent:nginx-agent /etc/nginx
chmod -R o-rwx /etc/nginx