{"id":"CVE-2026-96615","title":"Description\nNGINX Gateway Fabric has a vulnerability when it is configured with Gateway \n\nCustom Resource Definition (CRD) and have an authenticated gRPC connection with NGINX Agent","summary":"Description\nNGINX Gateway Fabric has a vulnerability when it is configured with Gateway \n\nCustom Resource Definition (CRD) and have an authenticated gRPC connection with NGINX Agent. A namespaced \n\n authenticated attacker with access to …","severity":"medium","cvss":6.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","cwe":["CWE-290"],"published":"2026-10-14","updated":"2026-10-14","sourceUpdated":"2026-10-14T16:04:11.750","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-96615","references":[{"url":"https://my.f5.com/manage/s/article/K000162610","label":"f5sirt@f5.com"}],"tags":["nvd"],"ingestedAt":"2026-10-14T15:36:14.034Z","slug":"CVE-2026-96615","body":"## Overview\n\nDescription\nNGINX Gateway Fabric has a vulnerability when it is configured with Gateway \n\nCustom Resource Definition (CRD) and have an authenticated gRPC connection with NGINX Agent. A namespaced \n\n authenticated attacker with access to a service account may impersonate the authenticated NGINX Agent gRPC connection to read TLS private keys of Gateway deployments in another namespace. \n\nImpact\nA remote authenticated attacker may be able to read TLS private keys of Gateway deployments in another namespace. \n\nThere is no data plane exposure; this is a control plane issue only.\n\n\n\n\n\n\nNote: Software versions which have reached End of Technical Support (EoTS) are not evaluated.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":36,"depthScoreParts":{"impact":35.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}