F5 NGINX Ingress Controller up to 5.6.x External Authentication authorization

Summaryinfo

A vulnerability described as problematic has been identified in F5 NGINX Ingress Controller up to 5.6.x. This vulnerability affects unknown code of the component External Authentication. The manipulation of the argument X-Forwarded-Prefix/X-Forwarded-URI/X-Original-URI/X-Forwarded-Method results in authorization. This vulnerability was named CVE-2026-94197. The attack may be performed from remote. There is no available exploit. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability was found in F5 NGINX Ingress Controller up to 5.6.x. It has been classified as problematic. Affected is an unknown code block of the component External Authentication. The manipulation of the argument X-Forwarded-Prefix/X-Forwarded-URI/X-Original-URI/X-Forwarded-Method with an unknown input leads to a authorization vulnerability. CWE is classifying the issue as CWE-639. The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data. This is going to have an impact on confidentiality. CVE summarizes:

An authentication and authorization bypass vulnerability exists in F5 NGINX Kubernetes Ingress Controller (NIC) when configured with the `ExternalAuth` policy or Ingress external authentication. Client-supplied X-Forwarded-Prefix, X-Forwarded-URI, X-Original-URI, and X-Forwarded-Method routing and method headers are forwarded unsanitized into the internal authentication subrequest (handled by the NGINX auth_request directive). As a result, an unauthenticated, remote attacker may spoof request attributes evaluated by the external authentication provider. Impact: This vulnerability may allow remote attackers unauthenticated access to protected paths. There is no control plane exposure; this is a data plane issue only. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

The advisory is shared for download at my.f5.com. This vulnerability is traded as CVE-2026-94197 since 09/30/2026. The exploitability is told to be easy. It is possible to launch the attack remotely. The exploitation doesn't require any form of authentication. There are known technical details, but no exploit is available. The current price for an exploit might be approx. USD $0-$5k (estimation calculated on 10/14/2026).

Upgrading to version 5.7.0 eliminates this vulnerability.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Type

• Web Server

Vendor

• F5

Name

• NGINX Ingress Controller

Version

• 5.0
• 5.1
• 5.2
• 5.3
• 5.4
• 5.5
• 5.6

License

• commercial

Website

• Vendor: https://f5.com/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion