CVE-2026-94197: F5 Nginx Ingress Controller

High severity, CVSS 7.5. EPSS: 0.4% chance of exploitation in the next 30 days.

An authentication and authorization bypass vulnerability exists in F5 NGINX Kubernetes Ingress Controller (NIC) when configured with the `ExternalAuth` policy or Ingress external authentication. Client-supplied X-Forwarded-Prefix, X-Forwarded-URI, X-Original-URI, and X-Forwarded-Method routing and method headers are forwarded unsanitized into the internal authentication subrequest (handled by the NGINX auth_request directive). As a result, an unauthenticated, remote attacker may spoof request attributes evaluated by the external authentication provider. Impact: This vulnerability may allow remote attackers unauthenticated access to protected paths. There is no control plane exposure; this is a data plane issue only. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Affected products

• F5 Nginx Ingress Controller: from 5.5.0, before 5.7.0 (fixed in 5.7.0)

Published 2026-10-14. Last modified 2026-10-15.