CVE-2026-66362
CVE-2026-66362 is a high-severity vulnerability with a CVSS 3.x base score of 8.1. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-76.
Key facts
- Severity: High (CVSS 3.x base score 8.1)
- CVSS v4: 8.6
- EPSS exploit prediction: 1% (45th percentile)
- Actively exploited: Not listed in CISA KEV
- Weakness: CWE-76
- Published:
- Last modified:
Description
Description: When NGINX Plus is configured as the data plane for NGINX Gateway Fabric, an injection vulnerability exists in the NGINX configuration generator component of NGINX Gateway Fabric. User-supplied string values from the Authentication Filter Custom Resource Definition clientID or cookieName fields, or in the clientSecret field of a Secret referenced by an Authentication Filter, are rendered directly into NGINX configuration templates without sanitization or escaping. Impact: An authenticated attacker with permission to create or modify these resources may craft values that inject arbitrary NGINX configuration directives. This is a control plane issue; there is no data plane exposure.
Frequently asked questions
- What is CVE-2026-66362?
- Description: When NGINX Plus is configured as the data plane for NGINX Gateway Fabric, an injection vulnerability exists in the NGINX configuration generator component of NGINX Gateway Fabric. User-supplied string values from the Authentication Filter Custom Resource Definition clientID or cookieName fields, or in the clientSecret field of a Secret referenced by an Authentication Filter, are rendered directly into NGINX configuration templates without sanitization or escaping. Impact: An authenticated attacker with permission to create or modify these resources may craft values that inject arbitrary NGINX configuration directives. This is a control plane issue; there is no data plane exposure.
- How severe is CVE-2026-66362?
- CVE-2026-66362 has a CVSS 3.x base score of 8.1, rated high severity. It is exploitable over network with low attack complexity, requires low privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability none.
- Is CVE-2026-66362 being actively exploited?
- It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (45th percentile), an estimate of the probability of exploitation in the next 30 days.
- How do I fix CVE-2026-66362?
- Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.
- When was CVE-2026-66362 published?
- CVE-2026-66362 was published on 2026-09-02 and last updated on 2026-09-03.
References
Other CWE-76 vulnerabilities
- CVE-2024-2952 — Critical (CVSS 9.8): BerriAI/litellm is vulnerable to Server-Side Template Injection (SSTI) via the `/completions` endpoint. The…
- CVE-2024-34359 — Critical (CVSS 9.6): llama-cpp-python is the Python bindings for llama.cpp. `llama-cpp-python` depends on class `Llama` in `llama.py` to…
- CVE-2026-54722 — High (CVSS 8.7): DSSRF is a Node.js library that provides a wide range of utilities and advanced SSRF defense checks. Prior to 1.0.4,…
- CVE-2024-4897 — High (CVSS 8.4): parisneo/lollms-webui, in its latest version, is vulnerable to remote code execution due to an insecure dependency on…
- CVE-2026-77180 — High (CVSS 8.3): When NGINX Ingress Controller is configured with Ingress annotations, an injection vulnerability exists in the…
- CVE-2026-55723 — High (CVSS 8.3): When NGINX Ingress Controller is configured with Custom Resource Definitions (CRDs) or Ingress annotations, an…