CVE search · CVE-2026-32682
CVE-2026-32682
high 7.1
When NGINX Gateway Fabric is configured using GRPCRoutes, an authenticated, remote attacker with permission to create or modify GRPCRoute resources can cause the NGINX Gateway Fabric control plane to terminate by sending undisclosed GRPCRoute configurations containing backendRef filters. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Details
- Status
- Analyzed
- Published
- Last changed
- Source
- f5sirt@f5.com
- Weakness
- CWE-129
Severity
| Version | Score | Vector | Source |
|---|---|---|---|
| CVSS 4.0 | high 7.1 | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
f5sirt@f5.comSecondary |
| CVSS 3.1 | medium 6.5 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H |
f5sirt@f5.comSecondary |
Affected products
Vendor and product from the NVD’s CPE applicability statements. Versions and conditions are on the NVD’s page.
- f5 · nginx_gateway_fabric
References
- https://my.f5.com/manage/s/article/K000161786Vendor Advisory