Medium severity6.5NVD Advisory· Published Jun 17, 2026· Updated Jul 2, 2026

CVE-2026-32682

Description

When NGINX Gateway Fabric is configured using GRPCRoutes, an authenticated, remote attacker with permission to create or modify GRPCRoute resources can cause the NGINX Gateway Fabric control plane to terminate by sending undisclosed GRPCRoute configurations containing backendRef filters.

Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Affected products

Nginxinc/Nginx Gateway Fabricinferred
NGINX Gateway Fabric/NGINX Gateway Fabricllm-create
osv-coords
pkg:bitnami/nginx-gateway-fabric
Range: >= 1.3.0, < 2.6.4

Patches

Vulnerability mechanics

References

my.f5.com/manage/s/article/K000161786nvdVendor Advisory

News mentions

No linked articles in our index yet.

cvss	0.423
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000