CVE-2026-104939 in NGINX Ingress Controller
Summary
by MITRE • 10/14/2026
Description NGINX Ingress Controller has a vulnerability when implementing an externalAuth policy for ingress. NGINX Ingress Controller may mishandle the HTTP response from an OAuth IdP and allow an attacker to acquire unauthenticated access to protected paths before the proper external authentication can happen.
Impact This vulnerability may allow remote attackers
unauthenticated
access to protected
paths. There is no control plane exposure; this is a data plane issue only.
Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/14/2026
The NGINX Ingress Controller serves as a critical component in modern Kubernetes environments, acting as the entry point for external traffic destined for services running within the cluster. It relies heavily on configuration policies to enforce security boundaries, including authentication and authorization mechanisms that protect backend applications from unauthorized access. One such mechanism is the externalAuth policy, which delegates identity verification to an external Identity Provider (IdP), typically implementing protocols like OAuth 2.0 or OpenID Connect. This architecture allows organizations to centralize user management while maintaining granular control over ingress traffic. However, a significant vulnerability has been identified in how this controller processes HTTP responses from these external authentication services during the initial stages of request handling.
The core technical flaw lies in the mishandling of specific HTTP response codes returned by the OAuth Identity Provider when it fails to authenticate or authorize a user. In a correctly implemented security flow, if an IdP determines that a client is unauthenticated, it should return a redirect or error code that instructs the ingress controller to halt processing and present a login page or deny access entirely. The vulnerability arises because the NGINX Ingress Controller fails to strictly enforce this rejection logic in certain edge cases involving malformed or unexpected response structures from the IdP. Instead of treating these responses as authentication failures, the controller may inadvertently interpret them as successful authorization events or bypasses, thereby allowing the request to proceed to the backend service without valid credentials. This behavior creates a race condition-like scenario where the security check is effectively short-circuited before proper external authentication can be completed.
This flaw results in a severe operational impact by enabling remote attackers to acquire unauthenticated access to protected paths within applications exposed through the ingress controller. An attacker could craft specific requests that trigger this misinterpretation of IdP responses, thereby bypassing login screens and accessing sensitive data or administrative functions without possessing valid user credentials. It is crucial to note that this vulnerability affects only the data plane, meaning it involves the processing of actual network traffic rather than the control plane configuration management. Consequently, while an attacker can exploit this to access protected resources, they do not gain direct control over the ingress controller's configuration or the underlying cluster infrastructure through this specific vector alone. However, unauthorized access to backend services often serves as a stepping stone for further lateral movement and deeper compromise within the environment.
From a classification perspective, this vulnerability aligns with CWE-287 Improper Authentication, where an actor is able to impersonate another by failing to properly verify identity credentials or tokens. Additionally, it relates to CWE-436 Interpretation Error, as the system incorrectly interprets the status of an authentication request due to flawed logic in parsing external responses. In terms of adversary tactics, this exploit maps to ATT&CK technique T1078 Valid Accounts, specifically involving the misuse of legitimate credentials or bypassing credential requirements through protocol manipulation. Attackers leveraging this flaw would likely engage in reconnaissance and initial access phases by probing ingress endpoints for misconfigured authentication handlers that exhibit this specific response handling behavior.
Mitigation strategies must focus on immediate patching and configuration hardening. The primary remediation is to upgrade the NGINX Ingress Controller to a version where this logic error has been corrected, ensuring that all responses from external IdPs are rigorously validated against expected success criteria before granting access. Administrators should also review their ingress configurations to ensure that fallback behaviors for authentication failures explicitly deny access rather than defaulting to allow or redirect in ambiguous states. Furthermore, implementing strict network segmentation and deploying Web Application Firewalls (WAF) can provide an additional layer of defense by inspecting traffic patterns associated with this specific bypass technique. Continuous monitoring of access logs for unusual authentication flows where requests appear to succeed without standard token validation is also recommended to detect potential exploitation attempts in real-time.