{"id":"CVE-2026-96615","state":"PUBLISHED","title":"NGINX Gateway Fabric vulnerability","description":"Description\nNGINX Gateway Fabric has a vulnerability when it is configured with Gateway \n\nCustom Resource Definition (CRD) and have an authenticated gRPC connection with NGINX Agent. A namespaced \n\n authenticated attacker with access to a service account may impersonate the authenticated NGINX Agent gRPC connection to read TLS private keys of Gateway deployments in another namespace. \n\nImpact\nA remote authenticated attacker may be able to read TLS private keys of Gateway deployments in another namespace. \n\nThere is no data plane exposure; this is a control plane issue only.\n\n\n\n\n\n\nNote: Software versions which have reached End of Technical Support (EoTS) are not evaluated.","publishedAt":"2026-10-14T14:40:28.213Z","updatedAt":"2026-10-15T16:43:46.898Z","severity":{"score":7.1,"label":"High","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","source":"f5"},"assigner":"f5","products":["F5 NGINX Gateway Fabric"],"affected":[{"vendor":"F5","product":"NGINX Gateway Fabric","defaultStatus":"unknown","versions":[{"version":"2.0.0","status":"affected","lessThan":"2.8.0","versionType":"custom"}],"modules":["NGF"]}],"references":["https://my.f5.com/manage/s/article/K000162610"],"weaknesses":["CWE-290"],"ingestedAt":"2026-10-29T20:13:43.249Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/96xxx/CVE-2026-96615.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-96615","state":"PUBLISHED","datePublished":"2026-10-14T14:40:28.213Z","dateUpdated":"2026-10-15T16:43:46.898Z","assignerShortName":"f5","assignerOrgId":"9dacffd4-cb11-413f-8451-fbbfd4ddc0ab","dateReserved":"2026-09-30T21:56:14.616Z"},"containers":{"cna":{"title":"NGINX Gateway Fabric vulnerability","descriptions":[{"lang":"en","value":"Description\nNGINX Gateway Fabric has a vulnerability when it is configured with Gateway \n\nCustom Resource Definition (CRD) and have an authenticated gRPC connection with NGINX Agent. A namespaced \n\n authenticated attacker with access to a service account may impersonate the authenticated NGINX Agent gRPC connection to read TLS private keys of Gateway deployments in another namespace. \n\nImpact\nA remote authenticated attacker may be able to read TLS private keys of Gateway deployments in another namespace. \n\nThere is no data plane exposure; this is a control plane issue only.\n\n\n\n\n\n\nNote: Software versions which have reached End of Technical Support (EoTS) are not evaluated."}],"affected":[{"vendor":"F5","product":"NGINX Gateway Fabric","defaultStatus":"unknown","versions":[{"version":"2.0.0","status":"affected","lessThan":"2.8.0","versionType":"custom"}],"modules":["NGF"]}],"references":[{"url":"https://my.f5.com/manage/s/article/K000162610","tags":["vendor-advisory"]}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]},{"cvssV4_0":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","baseScore":7.1,"baseSeverity":"HIGH","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-290","description":"CWE-290 Authentication Bypass by Spoofing","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"f5","orgId":"9dacffd4-cb11-413f-8451-fbbfd4ddc0ab","dateUpdated":"2026-10-14T14:40:28.213Z"},"credits":[{"lang":"en","type":"reporter","value":"F5 acknowledges Elias Hasas (GitHub: @zer0d4y5) for bringing this issue to our attention and following the highest standards of coordinated disclosure."}],"datePublic":"2023-01-01T00:00:00.000Z","impacts":[{"capecId":"CAPEC-151","descriptions":[{"lang":"en","value":"CAPEC-151 Identity Spoofing"}]}],"source":{"discovery":"EXTERNAL"},"workarounds":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"None"}],"value":"None"}],"x_generator":{"engine":"F5 SIRTBot v1.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-96615","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-15T15:53:16.545024Z"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-10-15T16:43:46.898Z"}}]}}}