NGINX Gateway Fabric has a vulnerability when it is configured with Gateway
Custom Resource Definition (CRD) and have an authenticated gRPC connection with NGINX Agent. A namespaced
authenticated attacker with access to a service account may impersonate the authenticated NGINX Agent gRPC connection to read TLS private keys of Gateway deployments in another namespace.
Impact
A remote authenticated attacker may be able to read TLS private keys of Gateway deployments in another namespace.
There is no data plane exposure; this is a control plane issue only.
Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Analysis
Analysis and contextual insights are available on OpenCVE Cloud.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| F5 | NGINX Gateway Fabric | unknown |
|
No data.
No data.
No data available yet.
Vendor Workaround
None
Tracking
Sign in to view the affected projects.
No advisories yet.
| Link | Providers |
|---|---|
| https://my.f5.com/manage/s/article/K000162610 |
|
Wed, 14 Oct 2026 15:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | Description NGINX Gateway Fabric has a vulnerability when it is configured with Gateway Custom Resource Definition (CRD) and have an authenticated gRPC connection with NGINX Agent. A namespaced authenticated attacker with access to a service account may impersonate the authenticated NGINX Agent gRPC connection to read TLS private keys of Gateway deployments in another namespace. Impact A remote authenticated attacker may be able to read TLS private keys of Gateway deployments in another namespace. There is no data plane exposure; this is a control plane issue only. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. | |
| Title | NGINX Gateway Fabric vulnerability | |
| Weaknesses | CWE-290 | |
| References |
| |
| Metrics |
cvssV3_1
|
Subscriptions
No data.
MITRE
Status: PUBLISHED
Assigner: f5
Published:
Updated: 2026-10-14T14:40:28.213Z
Reserved: 2026-09-30T21:56:14.616Z
Link: CVE-2026-96615
Vulnrichment
No data.
NVD
Status : Awaiting Analysis
Published: 2026-10-14T15:17:28.033
Modified: 2026-10-14T16:04:11.750
Link: CVE-2026-96615
Redhat
No data.
OpenCVE Enrichment
No data.
-
CWE-290
Authentication Bypass by Spoofing