---
id: CVE-2026-104939
title: >-
  Description

  NGINX Ingress Controller has a vulnerability when implementing an externalAuth
  policy for ingress
summary: >-
  Description

  NGINX Ingress Controller has a vulnerability when implementing an externalAuth
  policy for ingress. NGINX Ingress Controller may mishandle the HTTP response
  from an OAuth IdP and allow an attacker to acquire unauthenticated ac…
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N'
cwe:
  - CWE-303
published: '2026-10-14'
updated: '2026-10-14'
sourceUpdated: '2026-10-14T16:04:11.750'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-104939'
references:
  - url: 'https://my.f5.com/manage/s/article/K000162617'
    label: f5sirt@f5.com
tags:
  - nvd
ingestedAt: '2026-10-14T15:36:13.996Z'
---

## Overview

Description
NGINX Ingress Controller has a vulnerability when implementing an externalAuth policy for ingress. NGINX Ingress Controller may mishandle the HTTP response from an OAuth IdP and allow an attacker to acquire unauthenticated access to protected paths before the proper external authentication can happen.



Impact
This vulnerability may allow remote attackers 

unauthenticated

 access to protected 

paths. There is no control plane exposure; this is a data plane issue only.




Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.