Direct naar de inhoud
⚡ Kritieke cyberalerts voor jouw sector & systemen — direct in je inbox. Aanmelden →
cybernieuws.nl Cybersecurity en informatiebeveiling nieuws alerts live · 6 min 165 bronnen 1 kritiek 18 vandaag
CVE's Videos Dagbriefing

← Terug naar CVE-database

CVE-2026-96615

MEDIUM · 6.5 CVSS Gepubliceerd: CWE-290

Beschrijving NL

Description
NGINX Gateway Fabric has a vulnerability when it is configured with Gateway

Custom Resource Definition (CRD) and have an authenticated gRPC connection with NGINX Agent. A namespaced

authenticated attacker with access to a service account may impersonate the authenticated NGINX Agent gRPC connection to read TLS private keys of Gateway deployments in another namespace. Impact
A remote authenticated attacker may be able to read TLS private keys of Gateway deployments in another namespace. There is no data plane exposure; this is a control plane issue only. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Origineel (Engels) tonen

Description
NGINX Gateway Fabric has a vulnerability when it is configured with Gateway

Custom Resource Definition (CRD) and have an authenticated gRPC connection with NGINX Agent. A namespaced

authenticated attacker with access to a service account may impersonate the authenticated NGINX Agent gRPC connection to read TLS private keys of Gateway deployments in another namespace. 

Impact
A remote authenticated attacker may be able to read TLS private keys of Gateway deployments in another namespace. 

There is no data plane exposure; this is a control plane issue only.

Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

References