CVE-2026-94197 | F5 NGINX Ingress Controller up to 5.6.x External Authentication authorization

October 14, 2026 Yanac

A vulnerability marked as problematic has been reported in F5 NGINX Ingress Controller up to 5.6.x. This affects an unknown part of the component External Authentication. The manipulation of the argument X-Forwarded-Prefix/X-Forwarded-URI/X-Original-URI/X-Forwarded-Method leads to authorization bypass.

This vulnerability is uniquely identified as CVE-2026-94197. The attack is possible to be carried out remotely. No exploit exists.

It is suggested to upgrade the affected component.VulDB Recent EntriesRead More