CVE-2026-94197 F5 CVE debrief

Who should care

Kubernetes administrators, NGINX Ingress Controller users, security teams responsible for ingress controller security, and vulnerability management teams should assess exposure and verify configurations to prevent potential unauthorized access and spoofing of request attributes. This includes reviewing ExternalAuth policies, Ingress external authentication configurations, and ensuring proper authentication and authorization mechanisms are in place.

Why it matters

CVE-2026-94197 is a high-severity vulnerability in F5 NGINX Kubernetes Ingress Controller that allows unauthenticated remote attackers to bypass authentication and authorization mechanisms, potentially gaining access to protected paths. Kubernetes administrators, NGINX Ingress Controller users, and security teams should assess exposure and verify configurations to prevent potential unauthorized access and spoofing of request attributes.

• Potential unauthorized access to protected paths
• Spoofing of request attributes evaluated by external authentication providers
• Bypass of authentication and authorization mechanisms
• Possible lateral movement within the network

Technical summary

The vulnerability exists in F5 NGINX Kubernetes Ingress Controller (NIC) when configured with the ExternalAuth policy or Ingress external authentication. Client-supplied X-Forwarded-Prefix, X-Forwarded-URI, X-Original-URI, and X-Forwarded-Method routing and method headers are forwarded unsanitized into the internal authentication subrequest. This allows unauthenticated remote attackers to spoof request attributes evaluated by the external authentication provider, potentially gaining access to protected paths.

Defensive priority

Ingress Controller authentication and authorization mechanisms require immediate review and potential updates to mitigate this vulnerability.

Recommended defensive actions

• Review and update Ingress Controller configurations to ensure proper authentication and authorization mechanisms are in place.
• Verify that ExternalAuth policies and Ingress external authentication are properly configured and secured.
• Monitor for potential spoofing attempts and anomalous activity.
• Consider implementing additional security measures, such as IP restrictions or rate limiting, to mitigate potential attacks.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.

Evidence notes

The CVE record and source item provide details on the vulnerability, its impact, and affected versions. However, specific details on exploitation and victim impact are not provided. To verify, defenders should review the official advisory, assess configurations, and monitor for potential spoofing attempts and anomalous activity. Additional security measures, such as IP restrictions or rate limiting, may be considered to mitigate potential attacks. The vulnerability has a CVSS score of 7.5 and is classified as HIGH severity. Kubernetes

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.