What is CVE-2026-104939?

CVE-2026-104939 is a high-severity vulnerability in F5 nginx Ingress Controller, classified under Incorrect Implementation of Authentication Algorithm. CVSS score: 7.5/10. Published 2026-10-14.

How severe is CVE-2026-104939?

High severity. CVSS v3 base score is 7.5 out of 10.

Vulnerability in F5 nginx Ingress Controller

CVE-2026-104939

Description NGINX Ingress Controller has a vulnerability when implementing an externalAuth policy for ingress. NGINX Ingress Controller may mishandle the HTTP response from an OAuth IdP and allow an attacker to acquire unauthenticated access to protected paths before the proper external authentication can happen. Impact This vulnerability may allow remote attackers unauthenticated access to protected paths. There is no control plane exposure; this is a data plane issue only. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Published 2026-10-14 · last modified 2026-10-14.

CVSS v3 metric

CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N.

EPSS exploit prediction

No EPSS score from FIRST.org yet. New CVEs usually get one within a few days; no score means no signal yet, not low risk. How EPSS works.

Affected products

F5 nginx Ingress Controller

Weakness classification (CWE)

CWE-303 — Incorrect Implementation of Authentication Algorithm

References

my.f5.com/manage/s/article/K000162617 (vendor-advisory)

Frequently asked questions

What is CVE-2026-104939?: CVE-2026-104939 is a high-severity vulnerability in F5 nginx Ingress Controller, classified under Incorrect Implementation of Authentication Algorithm. CVSS score: 7.5/10. Published 2026-10-14.
How severe is CVE-2026-104939?: High severity. CVSS v3 base score is 7.5 out of 10.