CVE-2026-94197: 
NGINX Ingress Controller (NGINX Inc) vulnerability analysis and mitigation

CVE-2026-94197 is an authentication and authorization bypass vulnerability in F5 NGINX Kubernetes Ingress Controller (NIC) affecting versions 5.5.0 through 5.7.0 (exclusive). The flaw is triggered when the controller is configured with the ExternalAuth policy or Ingress external authentication, allowing unauthenticated remote attackers to spoof request attributes evaluated by the external authentication provider. It was published on October 14, 2026, and carries a CVSS v3.1 base score of 7.5 (High) and a CVSS v4.0 base score of 8.7 (High) (GitHub Advisory, F5 Advisory).

The root cause is classified as CWE-290 (Authentication Bypass by Spoofing). When the NGINX Ingress Controller is configured to use external authentication via the auth_request directive, it forwards client-supplied HTTP headers — specifically X-Forwarded-Prefix, X-Forwarded-URI, X-Original-URI, and X-Forwarded-Method — into the internal authentication subrequest without sanitization. An attacker can craft HTTP requests with manipulated values in these headers to misrepresent the request path or method to the external authentication provider, causing it to make incorrect authorization decisions and grant access to protected resources. No privileges, user interaction, or special preconditions beyond network access to the ingress are required; the vulnerability only manifests when ExternalAuth or Ingress external authentication is enabled (GitHub Advisory, F5 Advisory).

Successful exploitation allows an unauthenticated remote attacker to bypass external authentication controls and gain access to protected application paths on the data plane. The primary impact is a high confidentiality risk, as attackers may read sensitive data or access restricted API endpoints without valid credentials. There is no integrity or availability impact, and F5 explicitly notes there is no control plane exposure — the vulnerability is limited to the data plane (GitHub Advisory, F5 Advisory).

As of the disclosure date (October 14, 2026), there is no public proof-of-concept exploit and no evidence of active in-the-wild exploitation (GitHub Advisory). The EPSS score is 0.0, reflecting a currently low probability of exploitation in the near term. The vulnerability has not been added to the CISA Known Exploited Vulnerabilities (KEV) catalog. However, the attack requires no authentication, no user interaction, and no special privileges, making it straightforward to exploit if a PoC becomes available against affected deployments using ExternalAuth (F5 Advisory).

1. Reconnaissance: Identify internet-facing or cluster-accessible NGINX Ingress Controller instances running versions 5.5.0–5.6.x that are configured with the ExternalAuth policy or Ingress external authentication annotations.
2. Identify protected paths: Probe the target application to enumerate paths that return 401/403 responses, indicating they are protected by the external authentication provider.
3. Craft malicious headers: Construct an HTTP request to a protected path and inject spoofed values into one or more of the following headers: X-Forwarded-Prefix, X-Forwarded-URI, X-Original-URI, or X-Forwarded-Method. For example, set X-Forwarded-URI to a path that the external auth provider considers permitted (e.g., a public endpoint).
4. Send the request: Submit the crafted request to the NGINX Ingress Controller. The controller forwards the unsanitized headers to the auth_request subrequest endpoint.
5. Bypass authentication: The external authentication provider evaluates the spoofed header values instead of the actual request attributes, incorrectly grants authorization, and the NGINX Ingress Controller proxies the request to the protected backend.
6. Access protected resources: The attacker receives the response from the protected backend path, achieving unauthorized data access (GitHub Advisory, F5 Advisory).

• Network: HTTP requests to protected paths that include unexpected or anomalous X-Forwarded-Prefix, X-Forwarded-URI, X-Original-URI, or X-Forwarded-Method headers from external (non-trusted-proxy) sources; successful 200 responses to paths that should return 401/403 for unauthenticated clients.
• Logs: NGINX access logs showing requests to restricted paths with unusual header combinations resulting in successful (2xx) responses; auth_request subrequest logs showing mismatched URI or method values compared to the original request URI.
• Application Logs: External authentication provider logs showing authorization grants for paths or methods inconsistent with the actual inbound request, particularly for requests that lack valid session tokens or credentials.

F5 has released NGINX Ingress Controller version 5.7.0 to address this vulnerability; upgrading to 5.7.0 or later is the recommended remediation (F5 Advisory, GitHub Advisory). As a workaround for environments that cannot immediately upgrade, administrators should configure upstream load balancers or proxies to strip or block client-supplied X-Forwarded-Prefix, X-Forwarded-URI, X-Original-URI, and X-Forwarded-Method headers before they reach the ingress controller. Additionally, external authentication providers should be configured to validate request attributes independently rather than relying solely on forwarded headers. Note that versions that have reached End of Technical Support (EoTS) will not receive patches.