The vendor has published a fix. Version details are below where the sources state them.
Steps
Written by AI from the record
Check with your IT person (or F5 support) whether you are using F5 NGINX Gateway Fabric with NGINX Plus/Open Source as the data plane, and identify your exact version. 2) Update NGINX Gateway Fabric to the fixed release your vendor recommends, and verify the fix is deployed. 3) Review who can create/modify the relevant CRDs (especially the NginxProxy CRD setting for access log format) and tighten permissions to the minimum needed.
When NGINX Plus or NGINX Open Source is configured as the data plane for NGINX Gateway Fabric, an injection vulnerability exists in the NGINX configuration generator component of NGINX Gateway Fabric. User-supplied string values from the NginxProxy Custom Resource Definition (CRD) access log format setting are rendered directly into NGINX configuration templates without sanitization or escaping. An authenticated attacker with permission to create or modify these CRDs may craft values that inject arbitrary NGINX configuration directives. This is a control plane issue; there is no data plane exposure from the vulnerability trigger itself.
Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
In plain language
Written by AI from the record
CVE-2026-50107 is a NGINX Gateway Fabric control-plane injection flaw in F5 NGINX Gateway Fabric; most small businesses using it should act soon to patch or mitigate, even though no exploitation is publicly known.
What is it
Think of NGINX Gateway Fabric as an automated “configuration generator” that builds NGINX settings for you. This flaw lets a user who can change certain gateway settings insert text that becomes part of the generated NGINX configuration, like slipping extra instructions into a form that gets copied straight onto a live document. If an attacker has permission to create or modify the related CRDs, they may be able to make the system load unintended NGINX directives.
Who is affected
This matters to you if you run F5 NGINX Gateway Fabric with NGINX Plus or NGINX Open Source acting as the data plane. It is mainly a risk for environments where someone can create or edit NGINX Gateway Fabric CRDs (for example, a misconfigured team permission, stolen credentials, or an insider). If your business does not use NGINX Gateway Fabric in the way described, impact is not expected, but you should confirm your setup with your IT provider.
How urgent is it
This is rated HIGH and the issue is described as newly patched, so you should prioritize updates. However, there is currently no public evidence of active exploitation in the wild from the information provided, and there is no known public exploit. Treat it as an urgent “fix it promptly” item—especially if your environment allows people or service accounts to modify those CRDs.
What to do — in detail
Inventory and verify exposure
Confirm you are running F5 NGINX Gateway Fabric.
Confirm that NGINX Plus or NGINX Open Source is configured as the data plane for NGINX Gateway Fabric.
Identify the installed versions for F5 NGINX Gateway Fabric components and any bundled NGINX data-plane component.
Patch
Apply the vendor-provided fix for CVE-2026-50107 for your current F5 NGINX Gateway Fabric version.
If you cannot immediately patch, contact your vendor support for mitigation guidance specific to your deployment.
Reduce who can change CRDs (control-plane hardening)
Restrict Kubernetes permissions so only trusted identities can create or modify the relevant NGINX Gateway Fabric CRDs.
Specifically limit access related to the NginxProxy CRD fields controlling the access log format.
Ensure the service accounts used by automation have only the permissions required (least privilege).
Validate that the generator can’t be influenced
After patching, review the configuration generation path to ensure the fixed version properly sanitizes/escapes user-supplied string values in templates.
Confirm the deployment reconciles cleanly and that the generated NGINX config does not accept injected directives through those CRD string fields.
Monitoring to look for suspicious change attempts
Monitor for CRD changes that touch the access log format setting.
Alert on unexpected users/service accounts modifying CRDs, especially outside normal deployment workflows.
Look for unusual NGINX configuration changes following CRD updates.
Operational follow-up
Record the patch window and communicate that this is a control-plane issue.
Re-check permissions and audit logs periodically, since this flaw depends on an authenticated attacker being able to modify CRDs.
Technical context
CVE-2026-50107 (HIGH) affects F5 NGINX Gateway Fabric when NGINX Plus or NGINX Open Source is used as the data plane. The weakness is a configuration/template injection issue in the NGINX configuration generator component: values from the NginxProxy Custom Resource Definition (CRD) (specifically the access log format setting) are rendered into NGINX configuration templates without sanitization or escaping.
Attack vector: an authenticated attacker with permission to create or modify the relevant CRDs can supply crafted string values that inject arbitrary NGINX configuration directives. This is a control plane issue (the triggering mechanism is configuration generation), and the description states there is no direct data plane exposure from the vulnerability trigger itself.
Exploitation status: press information says none; CISA KEV is no; public exploit available: no; Nuclei detection template exists: no. EPSS/KEV: KEV (CISA Known Exploited Vulnerabilities) indicates whether a vulnerability is confirmed exploited; EPSS is not provided here, so it is not included in this assessment.
This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.
