Loading vulnerability…
External Authentication Bypass in F5 NGINX Ingress Controller
CVE-2026-104939 is an authentication bypass vulnerability in F5 NGINX Ingress Controller versions 5.6.0 through 5.6.3. When implementing an externalAuth policy for ingress, the controller may mishandle HTTP responses from an OAuth identity provider, allowing remote attackers to access protected paths before external authentication occurs. The vulnerability affects the data plane only and does not expose the control plane. Versions that have reached End of Technical Support were not evaluated.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Remote, unauthenticated attackers may bypass external authentication and access paths intended to require authentication. The resulting exposure is limited to protected application resources on the data plane; there is no control plane exposure.
If you can’t patch tonight, do this now.
F5 lists no mitigation or workaround.
Patch, then assume compromise.
Upgrade NGINX Ingress Controller versions 5.6.0 through 5.6.3 to version 5.7.0 or a later release containing the fix.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
8 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.