An injection vulnerability in F5 NGINX Gateway Fabric permits authenticated attackers to manipulate control plane configurations, posing a significant risk to system integrity.

This is an injection flaw (CWE-76) occurring within the configuration generator component, where user-supplied inputs from specific Authentication Filter fields are rendered without sanitization. The attacker must possess authenticated access with permissions to create or modify these resources to trigger the injection.

The ability to inject arbitrary NGINX configuration directives allows an attacker to alter the behavior of the control plane, potentially leading to unauthorized access or service disruption. While the impact is limited to the control plane and does not directly expose the data plane, the CVSS score of 8.1 indicates a high severity level that warrants immediate attention to prevent privilege escalation or system misconfiguration.

Immediate Action: Update F5 NGINX Gateway Fabric to version 2.6.8 or later to incorporate the necessary input sanitization and escaping for configuration templates.

Proactive Monitoring: Review audit logs for any unauthorized or suspicious modifications to Authentication Filter Custom Resource Definitions or associated secrets.

Compensating Controls: Restrict access to the Kubernetes resources responsible for Authentication Filter configurations to a strictly limited set of highly trusted administrators to mitigate the risk of malicious input injection.

Public Exploit Available: No (exploit_available: false)

This vulnerability represents a significant risk to the integrity of the NGINX Gateway Fabric control plane. Security teams should prioritize updating to the patched version, 2.6.8, immediately to remediate the injection vector. Following the update, conduct an audit of current Authentication Filter configurations to ensure no malicious directives have already been introduced to the environment.