Vulnerability · Published Jun 17, 2026 · Assigned by f5

CVE-2026-11311NGINX Gateway Fabric vulnerability

High 8.1

In plain English

A high-severity security flaw in NGINX Gateway Fabric from F5. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 47% of all known vulnerabilities).

Severity (CVSS 3.1)8.1High

Exploit odds (30 days)0.6%top 52.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

When NGINX Plus is configured as the data plane for NGINX Gateway Fabric, an injection vulnerability exists in the NGINX configuration generator component of NGINX Gateway Fabric. User-supplied string values from the NginxProxy Custom Resource Definition serverTokens field and the AuthenticationFilter Custom Resource Definition extraAuthArgs field are rendered directly into NGINX configuration templates without sanitization or escaping. An authenticated attacker with permission to create or modify these Custom Resource Definitions may craft values that inject arbitrary NGINX configuration directives. This is a control plane issue; there is no data plane exposure from the vulnerability trigger itself. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Ubuntu:22.04:LTS	nginx	no fix listed	UBUNTU-CVE-2026-11311
Ubuntu:24.04:LTS	nginx	no fix listed	UBUNTU-CVE-2026-11311
Ubuntu:25.10	nginx	no fix listed	UBUNTU-CVE-2026-11311
Ubuntu:26.04:LTS	nginx	no fix listed	UBUNTU-CVE-2026-11311

Affected products (as reported)

Vendor	Product	Versions
F5	NGINX Gateway Fabric	2.5.0 – before 2.6.4

Weakness: CWE-76 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

References

https://my.f5.com/manage/s/article/K000161611 vendor-advisory