CVE-2026-104939: NGINX Ingress Controller externalAuth can be bypassed

What it is

CVE-2026-104939 is an authentication bypass (CWE-303) in F5 NGINX Ingress Controller. When an externalAuth policy is set up for an ingress, the controller “may mishandle the HTTP response from an OAuth IdP.” An unauthenticated remote attacker may then reach protected paths before external authentication completes.

F5 says this is a data plane issue only, with no control plane exposure. The impact is on confidentiality: whatever sits behind the protected paths can be read. F5 scores it 7.5 (high) on CVSS 3.1 and 8.7 (high) on CVSS 4.0. The CVE record credits Carl Liljencrantz for reporting it.

We found no report of exploitation, no public proof of concept and no KEV listing as of October 15, 2026. The CVE was only published on October 14.

Am I affected?

You’re affected if both are true:

1. You run NGINX Ingress Controller 5.6.0 up to, but not including, 5.7.0.
2. You use an externalAuth policy on an ingress, backed by an OAuth identity provider.

Without an externalAuth policy, the CVE record gives no sign you’re exposed. F5 states that versions at End of Technical Support are not evaluated, so older releases are neither confirmed affected nor confirmed safe.

We could not open F5’s advisory (the myF5 page would not load), so we have no vendor-confirmed way to check your version or list your policies. Use your normal deployment inventory and confirm against K000162617.

What to do

1. Upgrade to NGINX Ingress Controller 5.7.0 or later. The affected range ends before 5.7.0. Confirm the fixed release in F5’s advisory.
2. Until you can upgrade, the CVE record lists no workaround. Consider limiting network access to the ingress controller and the applications behind externalAuth. This is general hardening, not F5 guidance.
3. Don’t rely on the protected path alone. If an application behind externalAuth holds sensitive data, check whether it enforces its own authentication.
4. If the controller was exposed while vulnerable, review access logs for the protected paths (see Detection). If you find requests that never authenticated, treat the data behind them as exposed and rotate any secrets it held.

Detection

No exploit traces have been published. From the nature of the bug, look in your ingress controller and application access logs for:

• Successful (2xx) responses on externalAuth-protected paths from clients with no matching successful authentication at your IdP.
• Requests to protected paths from unfamiliar addresses, back to at least October 14, 2026, the date the bug became public. The affected version range may have been exploitable earlier, so extend the search to your 5.6.x deployment date if you can.
• Odd timing: a protected-path request that completes while the IdP call is still pending or failed.

These are our suggestions, not vendor guidance.