CVE-2026-91184 F5 CVE debrief

Who should care

NGINX Gateway Fabric administrators, security teams, and tenants with co-located configurations should assess exposure and implement additional security measures. Operators, platform teams, and vulnerability management teams should review affected scope and vendor guidance to prioritize remediation and verify configurations.

Why it matters

CVE-2026-91184 is a high-severity vulnerability in NGINX Gateway Fabric that allows a remote authenticated attacker to inject arbitrary NGINX directives, potentially leading to unauthorized access, SSRF, or route hijacking. NGINX Gateway Fabric administrators and security teams should assess exposure and implement additional security measures to prevent exploitation.

• Potential unauthorized access to sensitive data
• Possible SSRF attacks via proxy_pass
• Hijacking of other tenants' routes
• Need for verification of affected versions and remediation

Technical summary

A vulnerability in NGINX Gateway Fabric allows a remote authenticated attacker to inject arbitrary NGINX directives into the data-plane config, potentially leading to unauthorized access to co-located tenant's mounted secrets, SSRF, or hijacking other tenants' routes. The issue arises from NGINX Gateway Fabric rendering the spec.basic.realm and spec.jwt.realm fields of a namespaced AuthenticationFilter verbatim, unescaped and unvalidated, into the shared data-plane nginx.conf as auth_basic <realm>;. This control plane issue does not expose the data plane.

Defensive priority

High priority for NGINX Gateway Fabric administrators and security teams

Recommended defensive actions

• Review and update NGINX Gateway Fabric configurations to prevent exploitation
• Implement additional security measures to detect and prevent control plane attacks
• Monitor for suspicious activity and update incident response plans
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record and source item provide details on the vulnerability in NGINX Gateway Fabric. The NVD entry is currently being processed. Evidence is limited to public CVE Program and NVD records, which may not reflect the full scope of affected products or versions. Defenders should verify vendor guidance and assess exposure based on available information.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.