High priorityDisclosed

Advisory · CVE-2026-104939

NGINX Ingress Controller externalAuth flaw can let attackers reach protected paths unauthenticated

NGINX Ingress Controller has a vulnerability when implementing an externalAuth policy for ingress: it may mishandle the HTTP response from an OAuth IdP and allow an attacker to acquire unauthenticated access to protected paths before proper external authentication can happen. F5 rates it CVSS 4.0 8.7 (CVSS 3.1 7.5), affecting the 5.6.0 line before 5.7.0.

Advisory published October 14, 2026Independent summary
Vendor
F5
Product
NGINX Ingress Controller
Identifier / CWE
CVE-2026-104939
CWE-303
Action timing
Immediate
ELI5

Explain it like I’m five

The bouncer checks the IdP's answer, misreads it, and waves the visitor in anyway.

SIMPLIFIED_ATTACK_PATH03 STEPS
  1. 01Crafted request arrives

    An attacker sends HTTP requests shaped to reach the affected NGINX configuration path.

  2. 02Worker memory corrupted or check bypassed

    The flaw takes effect in the NGINX worker or ingress data plane.

  3. 03Impact lands

    The attacker gains the access, crash, or code execution the flaw allows.

What happened

F5 disclosed CVE-2026-104939 for NGINX Ingress Controller: when an externalAuth policy is implemented for ingress, the controller may mishandle the HTTP response from an OAuth identity provider and grant unauthenticated access to protected paths before proper external authentication happens. F5 notes this is a data plane issue only, with no control plane exposure, and that versions which have reached End of Technical Support are not evaluated.

F5’s K000162617 lists the affected versions and the fixed builds. Match your deployment to the article before changing anything.

What to do

  1. Inventory every NGINX Ingress Controller deployment, including test, training, and individually managed instances.
  2. Apply the vendor fix or upgrade exactly as directed in the linked vendor bulletin or advisory.
  3. Restrict network access to NGINX Ingress Controller while remediation is underway, especially for internet-facing instances.
  4. Review application and server logs for requests reaching externalAuth-protected paths without matching IdP authentication events.
  5. Check for accounts, content, or configuration created outside normal change processes, and rotate exposed credentials where access cannot be ruled out.
  6. Verify the deployed version or patch level after remediation.

Management note

Auth bypass at the ingress is a front-door problem for every workload behind it. Patch the controller and audit access logs for the affected window.