CVE-2026-32682

When NGINX Gateway Fabric is configured using GRPCRoutes, an authenticated, remote attacker with permission to create or modify GRPCRoute resources can cause the NGINX Gateway Fabric control plane to terminate by sending undisclosed GRPCRoute configurations containing backendRef filters. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

CVSS v3 6.5 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://my.f5.com/manage/s/article/K000161786	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:f5:nginx_gateway_fabric::::::::
	cpe:2.3:a:f5:nginx_gateway_fabric::::::::

History

26 Oct 2026, 12:10

Type	Values Removed	Values Added
Summary		(es) Cuando NGINX Gateway Fabric se configura utilizando GRPCRoutes, un atacante autenticado y remoto con permiso para crear o modificar recursos GRPCRoute puede causar que el plano de control de NGINX Gateway Fabric termine al enviar configuraciones GRPCRoute no divulgadas que contienen filtros backendRef. Nota: Las versiones de software que han alcanzado el Fin del Soporte Técnico (EoTS) no se evalúan.

Information

Published : 2026-06-17 20:16

Updated : 2026-10-26 12:10

NVD link : CVE-2026-32682

Mitre link : CVE-2026-32682

CVE.ORG link : CVE-2026-32682

JSON object : View

Products Affected

f5

nginx_gateway_fabric

CWE

CWE-129

Improper Validation of Array Index

{"id": "CVE-2026-32682", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-32682", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-18T12:57:19.705230Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "f5sirt@f5.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 2.8}], "cvssMetricV40": [{"type": "Secondary", "source": "f5sirt@f5.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 7.1, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "f5sirt@f5.com", "affectedData": [{"vendor": "F5", "modules": ["GRPCRoutes"], "product": "NGINX Gateway Fabric", "versions": [{"status": "affected", "version": "1.3.0", "lessThan": "2.6.4", "versionType": "custom"}], "defaultStatus": "unknown"}]}], "published": "2026-06-17T20:16:50.197", "references": [{"url": "https://my.f5.com/manage/s/article/K000161786", "tags": ["Vendor Advisory"], "source": "f5sirt@f5.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "f5sirt@f5.com", "description": [{"lang": "en", "value": "CWE-129"}]}], "descriptions": [{"lang": "en", "value": "When NGINX Gateway Fabric is configured using GRPCRoutes, an authenticated, remote attacker with permission to create or modify GRPCRoute resources can cause the NGINX Gateway Fabric control plane to terminate by sending undisclosed GRPCRoute configurations containing backendRef filters. \n\n\nNote: Software versions which have reached End of Technical Support (EoTS) are not evaluated."}, {"lang": "es", "value": "Cuando NGINX Gateway Fabric se configura utilizando GRPCRoutes, un atacante autenticado y remoto con permiso para crear o modificar recursos GRPCRoute puede causar que el plano de control de NGINX Gateway Fabric termine al enviar configuraciones GRPCRoute no divulgadas que contienen filtros backendRef.\n\nNota: Las versiones de software que han alcanzado el Fin del Soporte T\u00e9cnico (EoTS) no se eval\u00faan."}], "lastModified": "2026-10-26T12:10:00.130", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:f5:nginx_gateway_fabric:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "15B7F1FD-0C49-460F-9CB8-23DA730EC4BE", "versionEndIncluding": "1.6.2", "versionStartIncluding": "1.3.0"}, {"criteria": "cpe:2.3:a:f5:nginx_gateway_fabric:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "8495C4C7-3BFA-49CD-B527-7E1EE9827634", "versionEndExcluding": "2.6.4", "versionStartIncluding": "2.0.0"}], "operator": "OR"}]}], "sourceIdentifier": "f5sirt@f5.com"}