CVE-2026-32682CWE-129

NGINX Gateway Fabric vulnerability

High · published June 17, 2026

CVSS v4.0
7.1
EPSS
1%
Percentile
42.0
In the wild
Unconfirmed
What it is

When NGINX Gateway Fabric is configured using GRPCRoutes, an authenticated, remote attacker with permission to create or modify GRPCRoute resources can cause the NGINX Gateway Fabric control plane to terminate by sending undisclosed GRPCRoute configurations containing backendRef filters.

Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

The record
Technical detail
CVSS v4.0
7.1 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
EPSS
0.00501 · 42.0th percentile
Weakness
CWE-129 · Improper Validation of Array Index
Published
2026-06-17T20:05Z
EPSS history
Timeline
  • 17 JUN 20:05Z
    NGINX Gateway Fabric vulnerability
    cvelistv5