F5 NGINX Ingress Controller: Authentication bypass via spoofed forwarded headers
Summary
F5 NGINX Ingress Controller (NIC) with ExternalAuth or Ingress external authentication forwards client-supplied X-Forwarded-Prefix, X-Forwarded-URI, X-Original-URI and X-Forwarded-Method headers unsanitized into the internal authentication subrequest. An unauthenticated remote attacker can spoof request attributes evaluated by the external auth provider and gain access to protected paths. The vendor describes this as a data plane issue only; the control plane is not exposed.
Affected
- F5 NGINX Ingress Controller 5.5.0 to below 5.7.0 (per F5 advisory table; verify against the full advisory)
- Only when ExternalAuth or Ingress external authentication is used
- Versions past End of Technical Support are not evaluated
Fixed in
- Upgrade to F5 NGINX Ingress Controller 5.7.0 or later
Workaround
- Configure the external authentication backend to ignore client-supplied X-Forwarded-* and X-Original-* headers, or make it evaluate session tokens rather than forwarded paths (per CVE record)
- Ensure the ingress does not trust these headers from clients (unvalidated suggestion, requires testing)
Exploitation
- Exploitation in the wild: Unknown.
- Public proof of concept: none found.
- CISA SSVC: exploitation none, automatable yes, technical impact partial.
- EPSS reported as 0.00393.
Our recommendation
- Check whether NIC 5.5.0 to 5.6.x is deployed with ExternalAuth or Ingress external authentication.
- If so, upgrade to NIC 5.7.0 or later with high priority.
- Until patched, apply the header-handling workaround after testing.
- Review what sits behind the auth gate (admin interfaces, customer data) and check logs for unexpected access.
- Also check CVE-2026-104939 if OAuth-based external auth is used.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- F5 advisory K000162611 my.f5.com
- F5 out-of-band notice K000163408 my.f5.com
- NGINX Ingress Controller release notes docs.nginx.com
- Vulners VulnRichment CVE-2026-94197 vulners.com
- VulDB entry 419928 vuldb.com
- Vulners VulnRichment CVE-2026-104939 vulners.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 04:02.
Original description (NVD)
An authentication and authorization bypass vulnerability exists in F5 NGINX Kubernetes Ingress Controller (NIC) when configured with the `ExternalAuth` policy or Ingress external authentication. Client-supplied X-Forwarded-Prefix, X-Forwarded-URI, X-Original-URI, and X-Forwarded-Method routing and method headers are forwarded unsanitized into the internal authentication subrequest (handled by the NGINX auth_request directive). As a result, an unauthenticated, remote attacker may spoof request attributes evaluated by the external authentication provider. Impact: This vulnerability may allow remote attackers unauthenticated access to protected paths. There is no control plane exposure; this is a data plane issue only. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.