NGINX Ingress Controller: Improper authentication handling in externalAuth
Summary
NGINX Ingress Controller with the externalAuth feature may mishandle the HTTP response from an OAuth identity provider. A remote, unauthenticated attacker can reach protected paths before external authentication completes. There is no control plane exposure; the issue affects the data plane only. F5 rates it CVSS v4.0 8.7, while VulDB rates it 5.3.
Affected
- F5 NGINX Ingress Controller 5.6.0 to before 5.7.0 (according to the CVE record)
- The F5 advisory K000162617 reportedly lists 5.6.0 to 5.6.3 (research notes; the full advisory could not be read, so verify)
- 4.x and 3.x: end of technical support, not evaluated
- 5.5 branch: Unknown.
Fixed in
- Upgrade to NGINX Ingress Controller 5.7.0 or later.
Workaround
- Unknown. No vendor-documented interim workaround was found.
Exploitation
- CISA SSVC: exploitation none, automatable yes, technical impact partial.
- No reports of exploitation in the wild found. A secondary source states it is not in CISA KEV (unverified).
- No public proof of concept found.
- EPSS about 0.0036 (low).
Our recommendation
- Inventory all NGINX Ingress Controller versions and check whether externalAuth is in use.
- Upgrade affected instances to 5.7.0 or later.
- Review access logs for unexpected access to protected paths.
- Read the full F5 advisory K000162617 and related advisory K000163408 for further guidance.
- Check the sibling issue CVE-2026-94197 (authentication bypass via header spoofing in externalAuth).
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- F5 advisory K000162617 my.f5.com
- NGINX Ingress Controller changelog docs.nginx.com
- Vulners VulnRichment CVE-2026-104939 vulners.com
- VulDB entry 419918 vuldb.com
- malware.news F5 AV26-1049 copy malware.news
- Vulners VulnRichment CVE-2026-94197 (sibling issue) vulners.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 04:04.
Original description (NVD)
Description NGINX Ingress Controller has a vulnerability when implementing an externalAuth policy for ingress. NGINX Ingress Controller may mishandle the HTTP response from an OAuth IdP and allow an attacker to acquire unauthenticated access to protected paths before the proper external authentication can happen. Impact This vulnerability may allow remote attackers unauthenticated access to protected paths. There is no control plane exposure; this is a data plane issue only. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.