CVE-2026-66362 NGF vulnerability
Authenticated attackers can inject arbitrary NGINX directives via unsanitized fields in Authentication Filter resources, potentially compromising the control plane.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-66362?
CVE-2026-66362 is a high-severity code injection vulnerability in F5 NGINX Gateway Fabric, published on 2 Sep 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Description: When NGINX Plus is configured as the data plane for NGINX Gateway Fabric, an injection vulnerability exists in the NGINX configuration generator component of NGINX Gateway Fabric. User-supplied string values from the Authentication Filter Custom Resource Definition clientID or cookieName fields, or in the clientSecret field of a Secret referenced by an Authentication Filter, are rendered directly into NGINX configuration templates without sanitization or escaping.
Impact: An authenticated attacker with permission to create or modify these resources may craft values that inject arbitrary NGINX configuration directives. This is a control plane issue; there is no data plane exposure.
Weakness: CWE-76
Which versions are affected by CVE-2026-66362?
1 open source package ship an affected version, including nginx-gateway-fabric.
| Package | Affected | Fixed in |
|---|---|---|
nginx-gateway-fabric Bitnami | From 2.5.0 | 2.6.8 |
How do I fix CVE-2026-66362?
Upgrade nginx-gateway-fabric to 2.6.8 or later.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2026-66362 being exploited?
There is no known exploitation of CVE-2026-66362 in the wild and no public exploit code.
Sources
Also known as BIT-nginx-gateway-fabric-2026-66362, GHSA-94x9-2xmh-58p8.