CVE-2026-11311: NGINX Gateway Fabric vulnerability

Synopsis

This is a configuration injection vulnerability in the NGINX configuration generator component of NGINX Gateway Fabric, affecting versions 2.5.0 through 2.6.3. An authenticated attacker with permission to create or modify NginxProxy or AuthenticationFilter Custom Resource Definitions can inject arbitrary NGINX configuration directives by supplying unsanitized values in the serverTokens or extraAuthArgs fields. Successful exploitation allows the attacker to read sensitive data and tamper with the NGINX configuration, potentially redirecting traffic or disabling access controls. A patched-image rebuild at version 2.6.4 is available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the Kubernetes API server or the NGINX Gateway Fabric control plane over the network to submit or modify Custom Resource Definitions.

• AuthenticationRequired

  Any low-privilege Kubernetes account with RBAC permission to create or update NginxProxy or AuthenticationFilter Custom Resource Definitions is sufficient to trigger the injection.

• Victim interactionNot required

  No victim interaction is needed; the attacker submits a malicious CRD value directly and the configuration generator processes it without any human approval step.

• Attack complexityDetail

  The exploit is reliable and condition-free; no race condition, memory layout dependency, or special environmental state is required to inject directives into the generated NGINX configuration.

Blast Radius

• Reads sensitive NGINX configuration internals, including upstream definitions, TLS settings, and any secrets rendered into the configuration at generation time.
• Modifies the effective NGINX configuration to redirect or proxy traffic to attacker-controlled destinations, bypassing intended routing rules.
• Disables or overwrites authentication directives injected by AuthenticationFilter resources, removing access controls from proxied services.
• The impact is confined to the NGINX Gateway Fabric control plane; the underlying data plane host and adjacent cluster workloads are not directly affected by the vulnerability trigger itself.