CVE-2026-32682 NGINX Gateway Fabric vulnerability
An authenticated attacker with GRPCRoute permissions can crash the NGINX Gateway Fabric control plane by sending malicious backendRef filters.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-32682?
CVE-2026-32682 is a high-severity denial of service vulnerability in F5 NGINX Gateway Fabric, published on 17 Jun 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
When NGINX Gateway Fabric is configured using GRPCRoutes, an authenticated, remote attacker with permission to create or modify GRPCRoute resources can cause the NGINX Gateway Fabric control plane to terminate by sending undisclosed GRPCRoute configurations containing backendRef filters.
Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Weakness: CWE-129
Which versions are affected by CVE-2026-32682?
1 open source package ship an affected version, including nginx-gateway-fabric. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
nginx-gateway-fabric Bitnami | From 1.3.0 | 2.6.4 |
Products include F5 Nginx Gateway Fabric.
How do I fix CVE-2026-32682?
Upgrade nginx-gateway-fabric to 2.6.4 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-32682 being exploited?
There is no known exploitation of CVE-2026-32682 in the wild and no public exploit code.
Other vulnerabilities in F5 NGINX Gateway Fabric
Sources
Also known as BIT-nginx-gateway-fabric-2026-32682, GHSA-vh3x-jr27-wpwh.