{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/nginx-kubernetes-ingress-controller/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:f5:nginx_kubernetes_ingress_controller:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.5,"id":"CVE-2026-94197"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["NGINX Kubernetes Ingress Controller"],"_cs_severities":["high"],"_cs_tags":["vulnerability","ingress","kubernetes"],"_cs_type":"advisory","_cs_vendors":["F5"],"content_html":"\u003cp\u003eF5 NGINX Kubernetes Ingress Controller (NIC) is vulnerable to an authentication and authorization bypass when configured with the ExternalAuth policy or Ingress external authentication. The vulnerability stems from the improper sanitization of client-supplied HTTP headers, specifically X-Forwarded-Prefix, X-Forwarded-URI, X-Original-URI, and X-Forwarded-Method. These headers are forwarded into the internal authentication subrequest handled by the NGINX auth_request directive. Because the ingress controller trusts these headers without sanitization, a remote, unauthenticated attacker can manipulate them to spoof request attributes evaluated by the external authentication provider. This flaw resides strictly in the data plane and does not expose the control plane, yet it permits unauthorized access to sensitive backend resources protected by the ingress controller.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThe vulnerability allows unauthenticated remote attackers to bypass security constraints and gain access to protected paths managed by the affected Kubernetes Ingress Controller. This constitutes a significant security risk for organizations relying on NIC for traffic management and path-level access control, potentially leading to unauthorized data exposure or interaction with internal microservices that assume authentication has been successfully validated at the ingress layer.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eInventory all ingress controller deployments to determine if the ExternalAuth policy or Ingress external authentication is active.\u003c/li\u003e\n\u003cli\u003eMonitor ingress traffic for anomalous HTTP headers, particularly where X-Forwarded-* headers contain unexpected characters or values inconsistent with the request path.\u003c/li\u003e\n\u003cli\u003eConsult the F5 security advisory to identify patched versions of NGINX Kubernetes Ingress Controller and perform upgrades in all affected clusters.\u003c/li\u003e\n\u003cli\u003eImplement strict header validation at the application level or via service mesh sidecars as a compensating control while the ingress controller is being patched.\u003c/li\u003e\n\u003c/ol\u003e\n","date_modified":"2026-10-14T16:38:40Z","date_published":"2026-10-14T16:38:40Z","id":"https://feed.craftedsignal.io/briefs/2026-10-nginx-ingress-auth-bypass/","summary":"An authentication and authorization bypass in F5 NGINX Kubernetes Ingress Controller (NIC) allows remote attackers to spoof request attributes and access protected paths by manipulating unsanitized X-Forwarded-* headers.","title":"Authentication Bypass in F5 NGINX Kubernetes Ingress Controller","url":"https://feed.craftedsignal.io/briefs/2026-10-nginx-ingress-auth-bypass/"}],"language":"en","title":"CraftedSignal Threat Feed - NGINX Kubernetes Ingress Controller","version":"https://jsonfeed.org/version/1.1"}