CVE-2026-66362: NGINX Gateway Fabric RCE Vulnerability

CVE-2026-66362 Overview

CVE-2026-66362 is a configuration injection vulnerability in NGINX Gateway Fabric when NGINX Plus is deployed as the data plane. The NGINX configuration generator component renders user-supplied strings from the Authentication Filter Custom Resource Definition (CRD) directly into NGINX configuration templates without sanitization or escaping. Affected fields include clientID, cookieName, and the clientSecret value in a referenced Kubernetes Secret. An authenticated attacker with permission to create or modify these resources can inject arbitrary NGINX configuration directives into the generated control plane configuration. F5 tracks this issue under support article K000162600 and classifies it under [CWE-76] (Improper Neutralization of Equivalent Special Elements).

Critical Impact
Authenticated users with CRD write access can inject arbitrary NGINX directives into the control plane configuration, altering gateway behavior across the cluster.

Affected Products

NGINX Gateway Fabric when configured with NGINX Plus as the data plane
NGINX configuration generator component of NGINX Gateway Fabric
Kubernetes environments consuming the Authentication Filter CRD

Discovery Timeline

2026-09-02 - CVE-2026-66362 published to the National Vulnerability Database (NVD)
2026-09-02 - Last updated in NVD database

Technical Details for CVE-2026-66362

Vulnerability Analysis

The flaw resides in the NGINX Gateway Fabric configuration generator. This component translates Kubernetes Custom Resources into NGINX configuration files that drive the NGINX Plus data plane. When an Authentication Filter CRD is processed, string fields are interpolated into templates as raw text.

Because the generator does not sanitize or escape input, an attacker can close a directive early and append new NGINX directives. The injected directives become part of the effective gateway configuration once the control plane reconciles the resource. F5 characterizes this as a control plane issue with no direct data plane exposure from unauthenticated network traffic.

Root Cause

The root cause is unsafe string interpolation into a configuration template. User-controlled values from clientID, cookieName, and the referenced Secret's clientSecret field are trusted as literal, well-formed tokens. NGINX configuration syntax uses whitespace, semicolons, and braces as structural delimiters, so any of these characters embedded in an attacker-controlled string can break out of the intended context. This pattern maps to [CWE-76] because equivalent special elements are not neutralized before being written into an interpreter-consumed artifact.

Attack Vector

Exploitation requires an authenticated principal with Kubernetes RBAC permission to create or modify Authentication Filter CRDs or the Secrets they reference. The attacker submits a resource containing crafted values in clientID, cookieName, or clientSecret. When the configuration generator renders the templates, the injected directives are written into the NGINX Plus configuration and become active on reload. Impact depends on the injected directives and may include altered routing, logging redirection, disabled authentication, or upstream redirection.

No verified public proof-of-concept code is available. Refer to the F5 Support Article K000162600 for vendor-specific technical details.

Detection Methods for CVE-2026-66362

Indicators of Compromise

Authentication Filter CRDs whose clientID or cookieName fields contain semicolons, braces, whitespace, or NGINX directive keywords such as return, proxy_pass, location, or access_log.
Secrets referenced by Authentication Filters where clientSecret decodes to values containing NGINX syntax characters rather than opaque credentials.
Unexpected diffs in generated NGINX configuration between reconciliation cycles.
NGINX Plus reload events correlated with recent CRD or Secret modifications by non-administrative service accounts.

Detection Strategies

Audit the Kubernetes API server log for create and update operations on Authentication Filter resources and referenced Secrets, filtering for non-administrative subjects.
Implement admission controller policies (OPA Gatekeeper, Kyverno) that validate Authentication Filter fields against a strict allowlist of characters.
Compare rendered NGINX configuration snapshots against a known-good baseline after each reconciliation.

Monitoring Recommendations

Forward Kubernetes audit logs and NGINX Gateway Fabric controller logs to a centralized analytics platform for correlation.
Alert on any Authentication Filter mutation followed by an NGINX reload originating from a service account not in the platform administrator group.
Track counts of unique Authentication Filter authors per namespace to surface anomalous write activity.

How to Mitigate CVE-2026-66362

Immediate Actions Required

Review Kubernetes RBAC bindings and revoke create and update permissions on Authentication Filter CRDs and their referenced Secrets from users who do not require them.
Inventory existing Authentication Filter resources and inspect clientID, cookieName, and referenced clientSecret values for injected NGINX syntax.
Apply the fixed release identified in the F5 Support Article K000162600 once available in your environment.

Patch Information

F5 documents remediation guidance in F5 Support Article K000162600. Upgrade NGINX Gateway Fabric to the fixed version listed in the vendor advisory. Verify that the configuration generator sanitizes user-supplied CRD fields before rendering them into NGINX configuration templates.

Workarounds

Restrict write access to Authentication Filter CRDs and their referenced Secrets to a small set of trusted administrators using Kubernetes RBAC.
Deploy an admission controller policy that rejects Authentication Filter resources containing NGINX metacharacters (;, {, }, newline) in clientID or cookieName.
Validate that clientSecret values in referenced Secrets conform to expected credential formats before applying them.
Where NGINX Plus data plane deployment is not required, use the open-source NGINX data plane, which is not affected by this control plane injection path.

bash

# Kyverno policy example: block NGINX metacharacters in Authentication Filter fields
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: block-authfilter-injection
spec:
  validationFailureAction: Enforce
  rules:
    - name: validate-authfilter-fields
      match:
        any:
          - resources:
              kinds:
                - AuthenticationFilter
      validate:
        message: "clientID and cookieName must not contain NGINX metacharacters."
        pattern:
          spec:
            oidc:
              clientID: "!*;*&!*{*&!*}*"
              cookieName: "!*;*&!*{*&!*}*"