CVE-2026-104939
NGINX Ingress Controller vulnerability
CVSS Score
7.5
EPSS Score
0.0%
EPSS Percentile
0th
Description NGINX Ingress Controller has a vulnerability when implementing an externalAuth policy for ingress. NGINX Ingress Controller may mishandle the HTTP response from an OAuth IdP and allow an attacker to acquire unauthenticated access to protected paths before the proper external authentication can happen. Impact This vulnerability may allow remote attackers unauthenticated access to protected paths. There is no control plane exposure; this is a data plane issue only. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
| CWE | CWE-303 |
| Vendor | f5 |
| Product | nginx ingress controller |
| Published | Oct 14, 2026 |
Stay Ahead of the Next One
Get instant alerts for f5 nginx ingress controller
Be the first to know when new high vulnerabilities affecting f5 nginx ingress controller are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
None
Affected Versions
F5 / NGINX Ingress Controller
5.6.0 < 5.7.0
Credits
F5 acknowledges Carl Liljencrantz for bringing this issue to our attention and following the highest standards of coordinated disclosure.