FKIE_CVE-2026-1642

Vulnerability from fkie_nvd - Published: 2026-02-04 15:16 - Updated: 2026-02-13 21:35
Severity ?
5.9 (Medium) - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
Summary
A vulnerability exists in NGINX OSS and NGINX Plus when configured to proxy to upstream Transport Layer Security (TLS) servers. An attacker with a man-in-the-middle (MITM) position on the upstream server side—along with conditions beyond the attacker's control—may be able to inject plain text data into the response from an upstream proxied server.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
References
f5sirt@f5.comhttps://my.f5.com/manage/s/article/K000159824Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://www.openwall.com/lists/oss-security/2026/02/05/1Mailing List, Third Party Advisory
Impacted products
Vendor Product Version
f5 nginx_gateway_fabric *
f5 nginx_gateway_fabric *
f5 nginx_ingress_controller *
f5 nginx_ingress_controller *
f5 nginx_ingress_controller *
f5 nginx_instance_manager *
f5 nginx_open_source *
f5 nginx_open_source *
f5 nginx_plus *
f5 nginx_plus r32
f5 nginx_plus r32
f5 nginx_plus r32
f5 nginx_plus r32
f5 nginx_plus r33
f5 nginx_plus r33
f5 nginx_plus r33
f5 nginx_plus r34
f5 nginx_plus r34
f5 nginx_plus r35
f5 nginx_plus r36
f5 nginx_plus r36
To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:f5:nginx_gateway_fabric:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "AE3A85CC-50DD-4BE7-A8BF-F2AA2744FCDB",
              "versionEndIncluding": "1.6.2",
              "versionStartIncluding": "1.2.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:f5:nginx_gateway_fabric:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "95483FC6-1850-4C56-95C6-D65AEF39C5E4",
              "versionEndExcluding": "2.4.1",
              "versionStartIncluding": "2.0.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:f5:nginx_ingress_controller:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "53459EB1-5EAE-4F38-86CC-303408A91124",
              "versionEndIncluding": "3.7.2",
              "versionStartIncluding": "3.4.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:f5:nginx_ingress_controller:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "73A1CDBB-49F6-4AB6-AA67-542FD8017D6A",
              "versionEndIncluding": "4.0.1",
              "versionStartIncluding": "4.0.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:f5:nginx_ingress_controller:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "48DC8DC2-497F-48F9-A68B-8EA8DAA507E0",
              "versionEndExcluding": "5.3.3",
              "versionStartIncluding": "5.0.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:f5:nginx_instance_manager:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "05880D9D-7C68-42A8-9374-8BF4E6403757",
              "versionEndIncluding": "2.21.0",
              "versionStartIncluding": "2.15.1",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:f5:nginx_open_source:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "156F74E8-589F-43FC-AD64-74E2BFD11A62",
              "versionEndExcluding": "1.28.2",
              "versionStartIncluding": "1.3.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:f5:nginx_open_source:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "6205FEE4-C23C-4FBA-953D-35E8B8644D64",
              "versionEndExcluding": "1.29.5",
              "versionStartIncluding": "1.29.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:f5:nginx_plus:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "E7600A88-7651-4D8E-A04A-3AA81C850CC5",
              "versionEndExcluding": "r35",
              "versionStartIncluding": "r33",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:f5:nginx_plus:r32:-:*:*:*:*:*:*",
              "matchCriteriaId": "36C4308E-651E-437C-84E7-10C542E3ADC2",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:f5:nginx_plus:r32:p1:*:*:*:*:*:*",
              "matchCriteriaId": "FA913184-EAAD-409E-99C6-AB979DAA93F3",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:f5:nginx_plus:r32:p2:*:*:*:*:*:*",
              "matchCriteriaId": "782DF180-1101-4D6A-A1D7-8DADBAF6D9D3",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:f5:nginx_plus:r32:p3:*:*:*:*:*:*",
              "matchCriteriaId": "FB0B11F2-4748-492B-9906-F8C4C5EAFF12",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:f5:nginx_plus:r33:p1:*:*:*:*:*:*",
              "matchCriteriaId": "46DC49B8-7286-4867-9CDA-1C1B469CD304",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:f5:nginx_plus:r33:p2:*:*:*:*:*:*",
              "matchCriteriaId": "43477C2E-7485-4146-B25C-F58D632CD85B",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:f5:nginx_plus:r33:p3:*:*:*:*:*:*",
              "matchCriteriaId": "6A25B9CF-02C0-42DE-9C70-F2AD3ACE3CEB",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:f5:nginx_plus:r34:p1:*:*:*:*:*:*",
              "matchCriteriaId": "7453D683-FCA7-46EE-BE49-5FD9A01D7F87",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:f5:nginx_plus:r34:p2:*:*:*:*:*:*",
              "matchCriteriaId": "A977BF9F-D165-4B93-B4D2-A177883A5E75",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:f5:nginx_plus:r35:-:*:*:*:*:*:*",
              "matchCriteriaId": "5D5FFD66-35C3-41AD-BD77-510E34A3AC6F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:f5:nginx_plus:r36:-:*:*:*:*:*:*",
              "matchCriteriaId": "E7E5F940-048A-446F-9A1E-074612CEA1AC",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:f5:nginx_plus:r36:p1:*:*:*:*:*:*",
              "matchCriteriaId": "7993A0FB-BE7E-4634-BF7F-FDEE3582D3E7",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "A vulnerability exists in NGINX OSS and NGINX Plus when configured to proxy to upstream Transport Layer Security (TLS) servers. An attacker with a man-in-the-middle (MITM) position on the upstream server side\u2014along with conditions beyond the attacker\u0027s control\u2014may be able to inject plain text data into the response from an upstream proxied server.\u00a0\u00a0Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated."
    },
    {
      "lang": "es",
      "value": "Una vulnerabilidad existe en NGINX OSS y NGINX Plus cuando est\u00e1 configurado para actuar como proxy hacia servidores upstream de Transport Layer Security (TLS). Un atacante con una posici\u00f3n de man-in-the-middle (MitM) en el lado del servidor upstream \u2014junto con condiciones fuera del control del atacante\u2014 podr\u00eda ser capaz de inyectar datos en texto plano en la respuesta de un servidor proxy upstream. Nota: Las versiones de software que han alcanzado el Fin del Soporte T\u00e9cnico (EoTS) no son evaluadas."
    }
  ],
  "id": "CVE-2026-1642",
  "lastModified": "2026-02-13T21:35:01.730",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "HIGH",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 5.9,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "NONE",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.2,
        "impactScore": 3.6,
        "source": "f5sirt@f5.com",
        "type": "Secondary"
      }
    ],
    "cvssMetricV40": [
      {
        "cvssData": {
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "attackComplexity": "LOW",
          "attackRequirements": "PRESENT",
          "attackVector": "NETWORK",
          "availabilityRequirement": "NOT_DEFINED",
          "baseScore": 8.2,
          "baseSeverity": "HIGH",
          "confidentialityRequirement": "NOT_DEFINED",
          "exploitMaturity": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "privilegesRequired": "NONE",
          "providerUrgency": "NOT_DEFINED",
          "subAvailabilityImpact": "NONE",
          "subConfidentialityImpact": "NONE",
          "subIntegrityImpact": "NONE",
          "userInteraction": "NONE",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "version": "4.0",
          "vulnAvailabilityImpact": "NONE",
          "vulnConfidentialityImpact": "NONE",
          "vulnIntegrityImpact": "HIGH",
          "vulnerabilityResponseEffort": "NOT_DEFINED"
        },
        "source": "f5sirt@f5.com",
        "type": "Secondary"
      }
    ]
  },
  "published": "2026-02-04T15:16:14.190",
  "references": [
    {
      "source": "f5sirt@f5.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://my.f5.com/manage/s/article/K000159824"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ],
      "url": "http://www.openwall.com/lists/oss-security/2026/02/05/1"
    }
  ],
  "sourceIdentifier": "f5sirt@f5.com",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-349"
        }
      ],
      "source": "f5sirt@f5.com",
      "type": "Secondary"
    },
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-345"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.