CVE-2026-66362
HighCVSS 8.1Exploitation Probability (EPSS)
Low risk24th percentile - higher than 24% of all known CVEs
Summary
A vulnerability in NGINX Gateway Fabric where user-supplied string values from the Authentication Filter Custom Resource Definition clientID or cookieName fields, or in the clientSecret field of a Secret, are rendered directly into NGINX configuration templates without sanitization or escaping.
Risk Assessment
An authenticated attacker with permission to create or modify these resources can inject arbitrary NGINX configuration directives. This is a control plane issue; no data plane exposure.
Recommendation
Update NGINX Gateway Fabric to a patched version. Restrict permissions to create and modify Authentication Filters and related Secrets.
Other vulnerabilities in NGINX Gateway Fabric
See all- CVE-2026-50107High
In NGINX Plus or NGINX Open Source configured as the data plane for NGINX Gateway Fabric, an injection vulnerability exists in the NGINX configuration generator component. User-supplied string values from the NginxProxy Custom Resource Definition access log format setting are rendered without sanitization, allowing for the injection of arbitrary NGINX configuration directives.
- CVE-2026-32682Medium
A vulnerability in NGINX Gateway Fabric allows an authenticated remote attacker with permission to create or modify GRPCRoute resources to cause the control plane to terminate by sending specially crafted GRPCRoute configurations containing backendRef filters.
- CVE-2026-11311High
In NGINX Gateway Fabric, when NGINX Plus is configured as the data plane, an injection vulnerability exists in the NGINX configuration generator component. User-supplied string values from the serverTokens field of the NginxProxy Custom Resource Definition and the extraAuthArgs field of the AuthenticationFilter Custom Resource Definition are rendered directly into NGINX configuration templates without sanitization or escaping. An authenticated attacker with permission to create or modify these Custom Resource Definitions may inject arbitrary NGINX configuration directives.
Original NVD description (English source)
Description: When NGINX Plus is configured as the data plane for NGINX Gateway Fabric, an injection vulnerability exists in the NGINX configuration generator component of NGINX Gateway Fabric. User-supplied string values from the Authentication Filter Custom Resource Definition clientID or cookieName fields, or in the clientSecret field of a Secret referenced by an Authentication Filter, are rendered directly into NGINX configuration templates without sanitization or escaping. Impact: An authenticated attacker with permission to create or modify these resources may craft values that inject arbitrary NGINX configuration directives. This is a control plane issue; there is no data plane exposure.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS