{"id":"CVE-2026-96615","revision":"e40079a2ee954fa0a5fe3c6578be69c9","records":[{"revision":"e40079a2ee954fa0a5fe3c6578be69c9","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-96615","aliases":[],"title":"NGINX Gateway Fabric vulnerability","description":"Description\nNGINX Gateway Fabric has a vulnerability when it is configured with Gateway \n\nCustom Resource Definition (CRD) and have an authenticated gRPC connection with NGINX Agent. A\u00A0namespaced \n\n authenticated attacker with access to a service account may impersonate the authenticated\u00A0NGINX Agent gRPC connection to read\u00A0TLS private keys of Gateway deployments in another namespace.\u00A0\n\nImpact\nA remote authenticated attacker may be able to\u00A0read TLS private keys of Gateway deployments in another namespace.\u00A0\n\nThere is no data plane exposure; this is a control plane issue only.\n\n\n\n\n\n\nNote: Software versions which have reached End of Technical Support (EoTS) are not evaluated.","state":0,"publishedAt":"2026-10-14T14:40:28.213+00:00","modifiedAt":"2026-10-15T16:43:46.898+00:00","affected":[{"ecosystem":"Vendor product","name":"NGINX Gateway Fabric","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"defaultStatus\": \"unknown\",\n                    \"modules\": [\n                        \"NGF\"\n                    ],\n                    \"product\": \"NGINX Gateway Fabric\",\n                    \"vendor\": \"F5\",\n                    \"versions\": [\n                        {\n                            \"lessThan\": \"2.8.0\",\n                            \"status\": \"affected\",\n                            \"version\": \"2.0.0\",\n                            \"versionType\": \"custom\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","score":6.5,"severity":"MEDIUM"},{"system":"CVSS 4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","score":7.1,"severity":"HIGH"}],"references":["https://my.f5.com/manage/s/article/K000162610"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-96615","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-96615","identifiers":["CVE-2026-96615"]},"retained":false,"historicalAffected":[]}],"coverage":[]}