{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-96615","assignerOrgId":"9dacffd4-cb11-413f-8451-fbbfd4ddc0ab","state":"PUBLISHED","assignerShortName":"f5","dateReserved":"2026-09-30T21:56:14.616Z","datePublished":"2026-10-14T14:40:28.213Z","dateUpdated":"2026-10-15T16:43:46.898Z"},"containers":{"cna":{"affected":[{"defaultStatus":"unknown","modules":["NGF"],"product":"NGINX Gateway Fabric","vendor":"F5","versions":[{"lessThan":"2.8.0","status":"affected","version":"2.0.0","versionType":"custom"}]}],"credits":[{"lang":"en","type":"reporter","value":"F5 acknowledges Elias Hasas (GitHub: @zer0d4y5) for bringing this issue to our attention and following the highest standards of coordinated disclosure."}],"datePublic":"2023-01-01T00:00:00.000Z","descriptions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"Description<br>NGINX Gateway Fabric has a vulnerability when it is configured with Gateway \n\nCustom Resource Definition (CRD) and have an authenticated gRPC connection with NGINX Agent. A&nbsp;namespaced \n\n authenticated attacker with access to a service account may impersonate the authenticated&nbsp;NGINX Agent gRPC connection to read&nbsp;TLS private keys of Gateway deployments in another namespace.&nbsp;<br><br>Impact<br>A remote authenticated attacker may be able to&nbsp;read TLS private keys of Gateway deployments in another namespace.&nbsp;\n\nThere is no data plane exposure; this is a control plane issue only.\n\n<br><br>\n\n\nNote: Software versions which have reached End of Technical Support (EoTS) are not evaluated."}],"value":"Description\nNGINX Gateway Fabric has a vulnerability when it is configured with Gateway \n\nCustom Resource Definition (CRD) and have an authenticated gRPC connection with NGINX Agent. A namespaced \n\n authenticated attacker with access to a service account may impersonate the authenticated NGINX Agent gRPC connection to read TLS private keys of Gateway deployments in another namespace. \n\nImpact\nA remote authenticated attacker may be able to read TLS private keys of Gateway deployments in another namespace. \n\nThere is no data plane exposure; this is a control plane issue only.\n\n\n\n\n\n\nNote: Software versions which have reached End of Technical Support (EoTS) are not evaluated."}],"impacts":[{"capecId":"CAPEC-151","descriptions":[{"lang":"en","value":"CAPEC-151 Identity Spoofing"}]}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]},{"cvssV4_0":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","baseScore":7.1,"baseSeverity":"HIGH","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-290","description":"CWE-290 Authentication Bypass by Spoofing","lang":"en","type":"CWE"}]}],"providerMetadata":{"orgId":"9dacffd4-cb11-413f-8451-fbbfd4ddc0ab","shortName":"f5","dateUpdated":"2026-10-14T14:40:28.213Z"},"references":[{"tags":["vendor-advisory"],"url":"https://my.f5.com/manage/s/article/K000162610"}],"source":{"discovery":"EXTERNAL"},"title":"NGINX Gateway Fabric vulnerability","workarounds":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"None"}],"value":"None"}],"x_generator":{"engine":"F5 SIRTBot v1.0"}},"adp":[{"metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-96615","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-15T15:53:16.545024Z"}}}],"title":"CISA ADP Vulnrichment","providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-15T16:43:46.898Z"}}]}}