PULSEUnderground Intel

EN VIVO32señales / 24h

FEED

ransomsilentransomgroup reclama a K.r.. ...s · Not Foundransombraincipher reclama a novagroupgbc.com · GB · Otherransombraincipher reclama a oflaherty-law.com · IE · Professional Servicesransombraincipher reclama a clinicaromero.com · AR · Healthcareransombraincipher reclama a sodali.com · US · Professional Servicesransombraincipher reclama a srsnodgrass.com · US · Professional Servicesransombraincipher reclama a prosomnus.com · US · Healthcareransombraincipher reclama a olyortho.com · US · Healthcareransombraincipher reclama a mvjllp.com · Not Foundransomaurora reclama a Allmand-Smith Limited · GB · Manufacturingransomn0n reclama a Hanjin Information Systems & Telecommunication Co., Ltd. · KR · Technologyransominterlock reclama a Coastal Alabama Community College · US · Educationransomsilentransomgroup reclama a Porter Hedges LLP · US · Professional Servicesransomhelix reclama a Westrock Coffee · US · Retail & E-Commerceransomsilentransomgroup reclama a K.r.. ...s · Not Foundransombraincipher reclama a novagroupgbc.com · GB · Otherransombraincipher reclama a oflaherty-law.com · IE · Professional Servicesransombraincipher reclama a clinicaromero.com · AR · Healthcareransombraincipher reclama a sodali.com · US · Professional Servicesransombraincipher reclama a srsnodgrass.com · US · Professional Servicesransombraincipher reclama a prosomnus.com · US · Healthcareransombraincipher reclama a olyortho.com · US · Healthcareransombraincipher reclama a mvjllp.com · Not Foundransomaurora reclama a Allmand-Smith Limited · GB · Manufacturingransomn0n reclama a Hanjin Information Systems & Telecommunication Co., Ltd. · KR · Technologyransominterlock reclama a Coastal Alabama Community College · US · Educationransomsilentransomgroup reclama a Porter Hedges LLP · US · Professional Servicesransomhelix reclama a Westrock Coffee · US · Retail & E-Commerce

← Todos los CVEs

CVE Watch15 oct 2026

CVE-2026-91184

Description NGINX Gateway Fabric has a vulnerability when it renders the spec.basic.realm (and spec.jwt.realm) field of a namespaced Authen

CVSS

8.8

Alto

EPSS

0.5%

p40

KEV

—

Exploit Today

12

0-100

Publicado: 14 oct 2026 · Última mod.: 15 oct 2026 · CWE-76

EPSS · 30d

0.5%EPSS · 30 días0.5%

2026-10-152026-10-20

Descripción técnica

Description NGINX Gateway Fabric has a vulnerability when it renders the spec.basic.realm (and spec.jwt.realm) field of a namespaced AuthenticationFilter verbatim, unescaped and unvalidated, into the shared data-plane nginx.conf as auth_basic "<realm>";. A namespaced authenticated attacker that configures AuthenticationFilter CRD to an HTTPRoute/GRPCRoute on a shared Gateway can craft a realm value that closes the quoted directive and the enclosing location {} block and injects arbitrary NGINX directives into that Gateway's data-plane config. Impact A remote authenticated attacker can send crafted requests to configure NGINX Gateway Fabric AuthenticationFilter CRD and may be able to read every co-located tenant's mounted secrets, SSRF via proxy_pass, reading the pod ServiceAccount token, or hijacking other tenants' routes. There is no data plane exposure; this is a control plane issue only. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Referencias oficiales

my.f5.comhttps://my.f5.com/manage/s/article/K000162609

CVEs relacionados

CVECVSSEPSSKEVRExplotTítuloVis.

CVE-2026-771808.3 ALT

——12When NGINX Ingress Controller is configured with Ingress annotations, an injection vulnerability exists in the configuration generator of NGINX Ingress Controller. Multiple user-controllable fields are written into the generated NGINX configuration without sanitization. An authenticated attacker with permission to create or modify these annotations may craft values that inject arbitrary NGINX configuration directives. Impact: An authenticated attacker granted write access to NGINX Ingress Controller Ingress annotations through the Kubernetes API may be able to inject arbitrary NGINX configuration directives, create or delete files, or disable services. There is no data plane exposure; this is a control plane issue only. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.49d CVE-2026-663628.1 ALT

——14Description: When NGINX Plus is configured as the data plane for NGINX Gateway Fabric, an injection vulnerability exists in the NGINX configuration generator component of NGINX Gateway Fabric. User-supplied string values from the Authentication Filter Custom Resource Definition clientID or cookieName fields, or in the clientSecret field of a Secret referenced by an Authentication Filter, are rendered directly into NGINX configuration templates without sanitization or escaping. Impact: An authenticated attacker with permission to create or modify these resources may craft values that inject arbitrary NGINX configuration directives. This is a control plane issue; there is no data plane exposure.49d CVE-2026-54722—

——14DSSRF is a Node.js library that provides a wide range of utilities and advanced SSRF defense checks. Prior to 1.0.4, is_url_safe in src/helpers.ts strips the @ userinfo delimiter with remove_at_symbol_in_string before new URL parses the URL, allowing an attacker-controlled URL to bypass internal-IP validation and cause a client using the original URL to reach an internal service. This issue is fixed in version 1.0.4.41d CVE-2026-557238.3 ALT

——13When NGINX Ingress Controller is configured with Custom Resource Definitions (CRDs) or Ingress annotations, an injection vulnerability exists in the configuration generator of NGINX Ingress Controller. Multiple user-controllable fields are written into the generated NGINX configuration without sanitization. An authenticated attacker with permission to create or modify these CRDs or annotations may craft values that inject arbitrary NGINX configuration directives. Impact: An authenticated attacker granted write access to NGINX Ingress Controller CRDs or Ingress annotations through the Kubernetes API may be able to inject arbitrary NGINX configuration directives, create or delete files, or disable services. There is no data plane exposure; this is a control plane issue only. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.98d CVE-2026-113118.1 ALT

——14When NGINX Plus is configured as the data plane for NGINX Gateway Fabric, an injection vulnerability exists in the NGINX configuration generator component of NGINX Gateway Fabric. User-supplied string values from the NginxProxy Custom Resource Definition serverTokens field and the AuthenticationFilter Custom Resource Definition extraAuthArgs field are rendered directly into NGINX configuration templates without sanitization or escaping. An authenticated attacker with permission to create or modify these Custom Resource Definitions may craft values that inject arbitrary NGINX configuration directives. This is a control plane issue; there is no data plane exposure from the vulnerability trigger itself. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.111d CVE-2026-282929.8 CRÍ

——21`simple-git`, an interface for running git commands in any node.js application, has an issue in versions 3.15.0 through 3.32.2 that allows an attacker to bypass two prior CVE fixes (CVE-2022-25860 and CVE-2022-25912) and achieve full remote code execution on the host machine. Version 3.23.0 contains an updated fix for the vulnerability.99d