CVE-2026-91184 in NGINX Gateway Fabric
Summary
by MITRE • 10/15/2026
Description
NGINX Gateway Fabric has a vulnerability when it renders the spec.basic.realm (and spec.jwt.realm) field of a namespaced AuthenticationFilter verbatim, unescaped and unvalidated, into the shared data-plane nginx.conf as auth_basic "<realm>";. A namespaced authenticated attacker that configures AuthenticationFilter CRD to an HTTPRoute/GRPCRoute on a shared Gateway can craft a realm value that closes the quoted directive and the enclosing location {} block and injects arbitrary NGINX directives into that Gateway's data-plane config.
Impact
A remote authenticated attacker can send crafted requests to configure NGINX Gateway Fabric AuthenticationFilter CRD and may be able to read every co-located tenant's mounted secrets, SSRF via proxy_pass, reading the pod ServiceAccount token, or hijacking other tenants' routes. There is no data plane exposure; this is a control plane issue only.
Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/15/2026
The vulnerability in NGINX Gateway Fabric represents a critical configuration injection flaw within the control plane, specifically affecting how namespaced AuthenticationFilter resources interact with the shared data-plane nginx.conf file. The core technical deficiency lies in the rendering of the spec.basic.realm and spec.jwt.realm fields. Instead of sanitizing or escaping user-supplied input, the system renders these values verbatim into the configuration string auth_basic "<realm>";. This lack of validation allows a malicious actor to manipulate the resulting NGINX directive syntax by injecting characters that break out of the quoted string context. By carefully crafting the realm value, an attacker can close the opening quote and potentially terminate the enclosing location block definition in the nginx.conf file.
This structural manipulation enables arbitrary code injection into the data-plane configuration without requiring direct access to the underlying NGINX server files. Because this is a control plane issue rather than a data plane exposure, the attack vector relies on an authenticated user who has permissions to configure AuthenticationFilter Custom Resource Definitions (CRDs) and associate them with HTTPRoute or GRPCRoute resources bound to a shared Gateway instance. The attacker exploits the trust relationship between the gateway controller and the configuration generator to inject malicious NGINX directives that override default security policies or introduce new routing rules.
The operational impact of this vulnerability is severe, as it effectively compromises the multi-tenant isolation provided by the gateway architecture. An attacker can leverage the injected configurations to read secrets mounted in co-located tenant pods, thereby gaining access to sensitive credentials and API keys stored within the cluster environment. Furthermore, the ability to inject proxy_pass directives facilitates Server-Side Request Forgery (SSRF) attacks, allowing the attacker to route traffic through the gateway to internal services that are not intended for external or cross-tenant access. This can lead to unauthorized data exfiltration from internal databases, metadata endpoints, or other backend systems.
Additionally, the vulnerability allows attackers to hijack routes belonging to other tenants by modifying routing rules within the shared gateway configuration. By injecting directives that redirect traffic, an attacker can intercept requests intended for legitimate services and potentially capture authentication tokens, including pod ServiceAccount tokens used for Kubernetes API access. This capability significantly escalates the risk from a simple misconfiguration to a full cluster compromise scenario where lateral movement becomes feasible across namespace boundaries. The absence of input validation on realm fields directly contradicts secure coding practices required for handling untrusted configuration inputs in multi-tenant environments.
From a classification perspective, this vulnerability aligns with CWE-94 Improper Control of Generation of Code (Code Injection) and CWE-77 Command Injection via Configuration Files. In the context of the MITRE ATT&CK framework, it relates to techniques involving T1505 Server Software Component: Web Shell or T1608 Install Residency Mechanism if persistent configuration changes are made, though primarily it falls under privilege escalation within the control plane and unauthorized access to cloud resources via SSRF. The attack requires authenticated access but leverages insufficient input validation on critical configuration parameters that directly influence system behavior.
Mitigation strategies must focus on strict input sanitization and escaping mechanisms for all fields rendered into NGINX configuration files. Developers should implement allow-listing or rigorous regex-based validation for the realm field to ensure it contains only alphanumeric characters and safe punctuation, preventing any special characters like quotes or semicolons from being processed. Additionally, implementing role-based access control (RBAC) restrictions can limit which users are permitted to create or modify AuthenticationFilter resources on shared gateways. Regular auditing of configuration changes and monitoring for anomalous patterns in nginx.conf generation logs can also help detect attempted exploitation before it impacts the data plane. Upgrading to a patched version that addresses this input validation gap is essential for maintaining security integrity in multi-tenant deployments.