CVE-2026-96615 is a vulnerability in F5 Networks
Published on October 14, 2026
NGINX Gateway Fabric vulnerability
Description
NGINX Gateway Fabric has a vulnerability when it is configured with Gateway
Custom Resource Definition (CRD) and have an authenticated gRPC connection with NGINX Agent. A namespaced
authenticated attacker with access to a service account may impersonate the authenticated NGINX Agent gRPC connection to read TLS private keys of Gateway deployments in another namespace.
Impact
A remote authenticated attacker may be able to read TLS private keys of Gateway deployments in another namespace.
There is no data plane exposure; this is a control plane issue only.
Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Vulnerability Analysis
CVE-2026-96615 can be exploited with network access, and requires small amount of user privileges. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have a high impact on confidentiality, with no impact on integrity and availability.
Weakness Type
Authentication Bypass by Spoofing
This attack-focused weakness is caused by improperly implemented authentication schemes that are subject to spoofing attacks.
Products Associated with CVE-2026-96615
Want to know whenever a new CVE is published for F5 Networks ? stack.watch will email you.
Affected Versions
F5 NGINX Gateway Fabric:- Version 2.0.0 and below 2.8.0 is affected.