CVE-2026-104939 F5 CVE debrief

Who should care

Defenders and administrators of NGINX Ingress Controller deployments should assess exposure and verify configurations to prevent potential unauthorized access. This includes reviewing NGINX Ingress Controller versions, configurations, and protected paths. Additionally, security teams and vulnerability management teams should prioritize verifying and mitigating this vulnerability to prevent potential security impacts.

Why it matters

CVE-2026-104939 is a HIGH-severity vulnerability in NGINX Ingress Controller that may allow unauthenticated access to protected paths. Defenders should verify configurations and assess exposure to prevent potential security impacts.

• Potential unauthenticated access to protected paths
• Need to verify NGINX Ingress Controller versions and configurations
• Possible impact on data plane security
• Requires assessment of exposure and compensating controls

Technical summary

NGINX Ingress Controller has a vulnerability when implementing an externalAuth policy for ingress. It may mishandle the HTTP response from an OAuth IdP, allowing an attacker to acquire unauthenticated access to protected paths before proper external authentication can happen. This issue is confined to the data plane and does not affect the control plane. The vulnerability's impact is limited to potential unauthorized access to protected paths, emphasizing the need for defenders to verify configurations and assess exposure.

Defensive priority

Defenders should prioritize verifying NGINX Ingress Controller versions and configurations, especially for protected paths. Assess exposure and implement compensating controls if necessary.

Recommended defensive actions

• Verify NGINX Ingress Controller versions and configurations
• Assess exposure of protected paths
• Implement compensating controls if necessary
• Monitor for potential unauthorized access attempts
• Review vendor advisories for additional guidance
• Conduct regular security audits to identify potential vulnerabilities
• Track changes to NGINX Ingress Controller deployments

Evidence notes

The CVE Program and NVD records provide details on the vulnerability. However, specific version information and remediation steps are limited. Defenders should verify NGINX Ingress Controller versions and configurations, especially for protected paths, and assess exposure to prevent potential security impacts. The lack of detailed version information and remediation steps in the CVE Program and NVD records may hinder defenders' ability to implement effective compensating controls.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.