CVE-2026-11311: NGINX Gateway Fabric Configuration Injection Vulnerability

Technical summary

CVE-2026-11311 is a CWE-74 (Improper Neutralization of Special Elements in Output) and CWE-76 (Improper Neutralization of Equivalent Special Elements) vulnerability in NGINX Gateway Fabric's configuration generator. The vulnerability stems from unsanitized rendering of user-supplied strings from NginxProxy.spec.serverTokens and AuthenticationFilter.spec.extraAuthArgs directly into NGINX configuration templates. An authenticated Kubernetes user with permissions to create or modify these Custom Resource Definitions (CRDs) can inject NGINX directives without validation or escaping. Since the vulnerability exists in the control-plane component that generates NGINX configuration, exploitation does not directly expose the data plane but allows an attacker to reconfigure how traffic is processed.

Business impact

This vulnerability could enable attackers with cluster access to manipulate gateway behavior, potentially leading to traffic interception, request smuggling, or denial of service. The impact depends on what NGINX directives an attacker can inject—possibilities include upstream redirection, request filtering bypass, or service disruption. Because exploitation requires existing authentication and RBAC permissions, the risk is primarily from insider threats or compromised service accounts with CRD modification rights. Organizations should assess whether untrusted users or external integrations have been granted permissions to modify NginxProxy or AuthenticationFilter resources.

Affected systems

NGINX Gateway Fabric, when deployed as the data plane controller for NGINX Plus, is affected. The vulnerability is specific to the configuration generator component and does not affect standalone NGINX Plus instances or other NGINX products. Versions that have reached End of Technical Support (EoTS) are explicitly not evaluated per the vendor's guidance. Confirm the specific affected versions against the F5 NGINX Gateway Fabric release notes and security advisories.

Exploitability

Exploitability is limited by the authentication and authorization requirements. An attacker must: (1) possess valid credentials to access the Kubernetes cluster, (2) have RBAC permissions to create or modify NginxProxy and/or AuthenticationFilter CRDs, and (3) understand NGINX configuration syntax to craft useful injections. This is not remotely exploitable without first compromising cluster credentials. The CVSS score of 8.1 (HIGH) reflects high integrity and confidentiality impact given the ability to redirect traffic and alter processing logic, offset by the prerequisite of valid authentication. No known public exploits have been added to CISA's KEV catalog.

Remediation

Apply the patched version of NGINX Gateway Fabric provided by F5. Verify the exact patched version against F5's official security advisory. Additionally, implement defense-in-depth controls: restrict RBAC permissions for NginxProxy and AuthenticationFilter CRD modifications to only trusted users or service accounts, audit all CRD modifications, and use Pod Security Policies or network policies to limit lateral movement if a service account is compromised. Input validation at the application level (before CRD submission) can further reduce risk.

Patch guidance

Obtain the patched NGINX Gateway Fabric version from F5's security advisories or release notes. Test the update in a non-production environment to verify compatibility with your NGINX Plus deployment and any custom configurations. Because this is a control-plane vulnerability, patching should be prioritized during a maintenance window but does not require immediate data-plane shutdown. Verify that the patch version is explicitly listed as addressing CVE-2026-11311 before deployment.

Detection guidance

Monitor Kubernetes audit logs for CRD creation and modification events targeting NginxProxy and AuthenticationFilter resources, especially by unexpected service accounts or users. Flag any CRD values containing suspicious NGINX directives (e.g., upstream blocks, proxy_pass modifications, or scripting directives). Review NGINX configuration dumps (e.g., via nginx -T or the NGINX Plus API) for unexpected directives that do not correspond to legitimate NginxProxy or AuthenticationFilter specifications. Implement admission controllers or policy engines (e.g., Kyverno, OPA/Gatekeeper) to validate CRD field contents against allowlists of safe strings.

Why prioritize this

A CVSS score of 8.1 and the ability to inject arbitrary NGINX configuration warrant prioritization, especially if your cluster allows untrusted users to modify gateway settings or if service accounts with CRD permissions have been compromised. However, the requirement for authentication and RBAC permissions means this is lower urgency than unauthenticated remote code execution vulnerabilities. Prioritize patching in environments where multiple teams or external integrations manage gateway configuration.

Risk score, explained

The CVSS 3.1 score of 8.1 (HIGH) is based on: Attack Vector (Network) — the vulnerability is triggered through Kubernetes API interactions; Attack Complexity (Low) — no special conditions are required beyond standard CRD submission; Privileges Required (Low) — valid authentication and RBAC permissions are required; User Interaction (None) — exploitation is automatic upon CRD creation; Scope (Unchanged) — impact is confined to NGINX and the services it proxies; Confidentiality Impact (High) — injected directives can redirect or log traffic; Integrity Impact (High) — traffic can be modified or rerouted; Availability Impact (None) — DoS is not inherent but may be possible depending on injected directives. The score reflects serious configuration-level control over traffic processing, tempered by the authentication prerequisite.

Frequently asked questions