CVE-2026-96615 NGINX Gateway Fabric vulnerability
Authenticated attackers can impersonate agents to read TLS private keys from other namespaces in NGINX Gateway Fabric deployments.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-96615?
CVE-2026-96615 is a high-severity missing authorization vulnerability in F5 NGINX Gateway Fabric, published on 14 Oct 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Description NGINX Gateway Fabric has a vulnerability when it is configured with Gateway
Custom Resource Definition (CRD) and have an authenticated gRPC connection with NGINX Agent. A namespaced
authenticated attacker with access to a service account may impersonate the authenticated NGINX Agent gRPC connection to read TLS private keys of Gateway deployments in another namespace.
Impact A remote authenticated attacker may be able to read TLS private keys of Gateway deployments in another namespace.
There is no data plane exposure; this is a control plane issue only.
Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Weakness: CWE-290
Which versions are affected by CVE-2026-96615?
1 open source package ship an affected version, including nginx-gateway-fabric.
| Package | Affected | Fixed in |
|---|---|---|
nginx-gateway-fabric Bitnami | From 2.0.0 | 2.8.0 |
How do I fix CVE-2026-96615?
Upgrade nginx-gateway-fabric to 2.8.0 or later.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-96615 being exploited?
There is no known exploitation of CVE-2026-96615 in the wild and no public exploit code.
Sources
Also known as BIT-nginx-gateway-fabric-2026-96615, GHSA-h8jf-9855-344m.