#NØØT_Security_Alerts 🚨 #ALERT — F5 NGINX INGRESS CONTROLLER: UNAUTHENTICATED ACCESS TO PROTECTED KUBERNETES APPLICATION ROUTES October 14, 2026 DISCLOSED BY: F5 Security PRODUCT: F5 NGINX Kubernetes Ingress Controller CVE: CVE-2026-94197 SEVERITY: HIGH — CVSS 3.1: 7.5 / CVSS 4.0: 8.7 WEAKNESS: CWE-290 — Authentication Bypass by Spoofing AFFECTED VERSIONS: NGINX Ingress Controller 5.5.0 through versions earlier than 5.7.0. IMPACT: An authentication and authorization bypass can expose application routes intended to require authentication. EXPOSURE: The deployment must use an ExternalAuth policy or Ingress external authentication. The vulnerable controller forwards certain client-supplied headers into internal authentication subrequests without sufficient sanitization. Relevant headers include: X-Forwarded-Prefix X-Forwarded-URI X-Original-URI X-Forwarded-Method An unauthenticated remote attacker may manipulate request attributes evaluated by the external authentication provider. Successful exploitation could allow unauthorized access to protected application paths. The vulnerability affects the data plane. Direct compromise of the Kubernetes control plane is NOT established. EXPLOITATION STATUS: VENDOR-CONFIRMED AUTHENTICATION BYPASS. No confirmed malicious exploitation in the wild or independently verified working public exploit established. Forensic triage: Review ingress access logs and external authentication service logs. Investigate unexpected forwarded-header values, discrepancies between requested and authorized paths, and successful access without corresponding authentication. No confirmed attacker-specific IOCs published. URGENT ACTION: Upgrade affected NGINX Ingress Controller installations to version 5.7.0 or later. Review ExternalAuth configurations. Restrict direct access to sensitive upstream services. Ensure authorization decisions cannot be manipulated through untrusted client-controlled headers. SOURCE: https://my.f5.com/manage/s/article/K000162611 OFFICIAL CVE RECORD: https://github.com/CVEProject/cvelistV5/blob/main/cves/2026/94xxx/CVE-2026-94197.json CONFIDENCE: HIGH — F5-authored CVE record establishes the vulnerability, exposure conditions, affected releases and authorization-bypass impact. Active exploitation: NOT VERIFIED. #CyberSecurity #ThreatIntel #F5 #NGINX #KubernetesSecurity #AuthenticationBypass