CVE-2026-66362: Injection Vulnerability in NGINX Gateway Fabric

CVE-2026-66362 describes an injection vulnerability within the NGINX Gateway Fabric, specifically affecting the configuration generator component. When NGINX Plus is utilized as the data plane, user-supplied strings provided in the 'clientID' or 'cookieName' fields of an Authentication Filter Custom Resource Definition (CRD), or the 'clientSecret' field within a referenced Secret, are not properly sanitized or escaped. These values are rendered directly into NGINX configuration templates. An authenticated attacker who possesses the necessary Kubernetes role-based access control (RBAC) permissions to create or modify these specific resource types can inject arbitrary NGINX directives. This issue is strictly contained within the control plane, allowing for configuration-level manipulation rather than direct data plane exposure.

Impact

Successful exploitation allows an authenticated attacker to manipulate the NGINX control plane. This could lead to a denial of service, modification of request routing, or unauthorized bypasses of authentication logic, depending on the specific directives injected. The vulnerability is scoped to environments where NGINX Gateway Fabric is deployed with NGINX Plus as the data plane, impacting users of the Kubernetes-native ingress infrastructure.

Recommendation

• Audit Kubernetes RBAC policies to restrict who can create or modify Authentication Filter CRDs and associated Secrets.
• Prioritize monitoring and validation of Kubernetes resource changes associated with NGINX Gateway Fabric.
• Review the official NGINX security advisory for this CVE to confirm patch availability and upgrade instructions for NGINX Gateway Fabric.