CVE-2026-94197

Name of the Vulnerable Software and Affected Versions F5 NGINX Kubernetes Ingress Controller versions 5.5.0 through 5.6.x

Description An authentication and authorization bypass exists when the system is configured with the ExternalAuth policy or Ingress external authentication. The controller forwards client-supplied headers into internal authentication subrequests handled by the auth request directive without sufficient sanitization. An unauthenticated remote attacker can manipulate these request attributes to spoof information evaluated by the external authentication provider, potentially gaining unauthorized access to protected application paths. This is a data plane issue and does not expose the control plane. The affected headers include X-Forwarded-Prefix, X-Forwarded-URI, X-Original-URI, and X-Forwarded-Method.

Recommendations Upgrade F5 NGINX Kubernetes Ingress Controller to version 5.7.0 or later. Restrict direct access to sensitive upstream services. Ensure authorization decisions cannot be manipulated through untrusted client-controlled headers.