CVE-2026-32682
NGINX Gateway Fabric vulnerability
- State
- Published
- Severity
- 7.1 High
- Published
- Jun 17, 2026
- Updated
- Jun 18, 2026
- Reserved
- Jun 17, 2026
Description
When NGINX Gateway Fabric is configured using GRPCRoutes, an authenticated, remote attacker with permission to create or modify GRPCRoute resources can cause the NGINX Gateway Fabric control plane to terminate by sending undisclosed GRPCRoute configurations containing backendRef filters.
Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 7.1 High | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N | f5 |
| 3.1 | 6.5 Medium | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H | f5 |
Weaknesses
- CWE-129 Improper Validation of Array Index
Affected Products
| Product | Versions |
|---|---|
NGINX Gateway FabricF5 |
|
References
- https://my.f5.com/manage/s/article/K000161786vendor-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.