Skip to content
Threat Feed
Subscribe

CPE

Cpe:2.3:a:f5:nginx_app_protect_waf:*:*:*:*:*:*:*:*

1 brief RSS
high advisory

CVE-2026-50107: NGINX Gateway Fabric Configuration Injection Vulnerability

An injection vulnerability, CVE-2026-50107, exists in the NGINX configuration generator component of NGINX Gateway Fabric when configured with NGINX Plus or NGINX Open Source as the data plane, allowing authenticated attackers with CRD modification permissions to inject arbitrary NGINX configuration directives via unsanitized user-supplied string values in the access log format setting, leading to control plane compromise and potential defense evasion or system impact.

PoC NGINX Plus +10 config-injection nginx kubernetes cloud-native web-vulnerability cve
2r 1t 5c 2i updated