Vulnerability · Published Sep 2, 2026 · Assigned by f5

CVE-2026-66362NGF vulnerability

High 8.1

In plain English

A high-severity security flaw in NGINX Gateway Fabric from F5. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 48% of all known vulnerabilities).

Severity (CVSS 3.1)8.1High

Exploit odds (30 days)0.6%top 52.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Description: When NGINX Plus is configured as the data plane for NGINX Gateway Fabric, an injection vulnerability exists in the NGINX configuration generator component of NGINX Gateway Fabric. User-supplied string values from the Authentication Filter Custom Resource Definition clientID or cookieName fields, or in the clientSecret field of a Secret referenced by an Authentication Filter, are rendered directly into NGINX configuration templates without sanitization or escaping. Impact: An authenticated attacker with permission to create or modify these resources may craft values that inject arbitrary NGINX configuration directives. This is a control plane issue; there is no data plane exposure.

Affected products (as reported)

Vendor	Product	Versions
F5	NGINX Gateway Fabric	2.5.0 – before 2.6.8

Weakness: CWE-76 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

References

https://my.f5.com/manage/s/article/K000162600 vendor-advisory