CVE-2026-104939: 
NGINX Ingress Controller (NGINX Inc) vulnerability analysis and mitigation

CVE-2026-104939 is an authentication bypass vulnerability in F5's NGINX Ingress Controller affecting versions 5.6.0 through 5.6.x (fixed in 5.7.0). The flaw occurs when implementing an externalAuth policy for ingress: the controller mishandles HTTP responses from an OAuth Identity Provider (IdP), allowing unauthenticated attackers to access protected paths before proper authentication occurs. It carries a CVSS v3.1 score of 7.5 (High) and a CVSS v4.0 score of 8.7 (High), with impact limited to the data plane — no control plane exposure exists (GitHub Advisory, F5 Advisory).

The root cause is classified as CWE-303 (Incorrect Implementation of Authentication Algorithm), mapped to CAPEC-90 (Reflection Attack in Authentication Protocol). When NGINX Ingress Controller processes the HTTP response returned by an external OAuth IdP as part of an externalAuth ingress policy, it incorrectly evaluates or misroutes the response in a way that permits requests to reach protected backend paths without completing the authentication handshake. Exploitation requires no privileges, no user interaction, and is reachable over the network with low attack complexity, making it trivially exploitable against any exposed ingress endpoint configured with externalAuth (GitHub Advisory, F5 Advisory).

Successful exploitation allows an unauthenticated remote attacker to access backend paths that are intended to be protected by OAuth-based external authentication, resulting in a high confidentiality impact. Sensitive data served behind the ingress — such as APIs, internal dashboards, or application data — may be exposed without any credential requirement. The vulnerability is strictly a data plane issue; Kubernetes control plane components and NGINX Ingress Controller management interfaces are not affected (GitHub Advisory, F5 Advisory).

As of the disclosure date (October 14, 2026), there is no public proof-of-concept exploit and no evidence of active in-the-wild exploitation (GitHub Advisory). The EPSS score is 0.0, reflecting a currently low probability of near-term exploitation. The CVE is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported.

1. Reconnaissance: Identify internet-facing Kubernetes clusters running NGINX Ingress Controller versions 5.6.0–5.6.x with externalAuth policies configured, using tools like Shodan, Censys, or by inspecting publicly accessible ingress endpoints.
2. Identify protected paths: Enumerate ingress routes that redirect to an OAuth IdP for authentication (e.g., paths returning HTTP 302 redirects to an authorization server).
3. Craft malicious request: Send a crafted HTTP request to a protected path, manipulating request headers or timing to exploit the mishandling of the OAuth IdP response by the ingress controller.
4. Bypass authentication: The controller incorrectly processes the IdP response and forwards the request to the backend without completing the OAuth flow, granting the attacker unauthenticated access to the protected resource.
5. Access sensitive data: Retrieve sensitive application data, APIs, or internal resources that were intended to require valid OAuth credentials (GitHub Advisory, F5 Advisory).

• Network: Unexpected HTTP requests to protected ingress paths that do not include valid OAuth tokens or session cookies; absence of OAuth redirect flows (no HTTP 302 to IdP) for requests that successfully reach protected backends.
• Logs: NGINX Ingress Controller access logs showing successful HTTP 200 responses to protected paths from unauthenticated clients (no Authorization header or valid session); anomalous patterns where requests bypass the expected OAuth redirect chain.
• Application: Backend application logs showing requests from unknown or unexpected source IPs accessing authenticated-only endpoints without corresponding session records in the IdP or application session store.

F5 has released NGINX Ingress Controller version 5.7.0 to address this vulnerability; upgrading immediately is the recommended remediation (F5 Advisory). Organizations unable to upgrade immediately should review access logs for protected paths to identify any unauthorized access during the affected period (versions 5.6.0–5.6.x). After patching, verify that OAuth externalAuth policies are correctly enforcing authentication on all protected ingress routes. Note that versions that have reached End of Technical Support (EoTS) are not evaluated and will not receive patches.