CVE-2026-50107: NGINX Gateway Fabric vulnerability

Synopsis

This is a configuration injection vulnerability in NGINX Gateway Fabric, affecting versions 2.3.0 through 2.6.3. An authenticated attacker who has permission to create or modify NginxProxy Custom Resource Definitions can inject arbitrary NGINX configuration directives by supplying unsanitized values into the access log format setting of the configuration generator. Successful exploitation gives the attacker the ability to read sensitive data and tamper with configuration-driven behavior on the control plane. A patched-image rebuild at version 2.6.4 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the Kubernetes API server or the cluster control plane over the network to submit or modify NginxProxy CRD resources.

• AuthenticationRequired

  The attacker must hold a low-privilege account with Kubernetes RBAC permissions to create or modify NginxProxy CRD objects; anonymous access is not sufficient.

• Victim interactionNot required

  No victim interaction is needed; the injected configuration is rendered the next time the NGINX Gateway Fabric configuration generator processes the CRD.

• Attack complexityDetail

  The exploit is reliable and condition-free; no race conditions or special environmental layout are required to inject directives into the generated NGINX configuration.

Blast Radius

• Reads sensitive values accessible through injected NGINX directives, such as upstream connection details or internal header content captured in access logs.
• Modifies the effective NGINX configuration by inserting arbitrary directives, altering routing rules, timeouts, or access controls beyond what the legitimate CRD schema permits.
• Expands the attack surface for follow-on exploitation by staging malicious NGINX directives that affect how requests are proxied or logged across all virtual servers managed by the Gateway Fabric instance.