What is GHSA-qcp7-h72p-6whw?

GHSA-qcp7-h72p-6whw is a security advisory published by GitHub Security Advisories with High severity. Description NGINX Ingress Controller has a vulnerability when implementing an externalAuth policy...

Which CVE IDs does GHSA-qcp7-h72p-6whw cover?

GHSA-qcp7-h72p-6whw covers the following CVE IDs: CVE-2026-104939. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-qcp7-h72p-6whw?

GHSA-qcp7-h72p-6whw has a CVSS v3 base score of 7.5, published by GitHub Security Advisories.

GHSA-qcp7-h72p-6whwHighCVSS 7.5

Description NGINX Ingress Controller has a vulnerability when implementing an externalAuth policy...

Vendor

GitHub Security Advisories

Published

October 14, 2026

Last Modified

October 14, 2026

🔗 CVE IDs covered (1)

CVE-2026-104939 →

📋 Description

Description NGINX Ingress Controller has a vulnerability when implementing an externalAuth policy for ingress. NGINX Ingress Controller may mishandle the HTTP response from an OAuth IdP and allow an attacker to acquire unauthenticated access to protected paths before the proper external authentication can happen.

Impact This vulnerability may allow remote attackers

unauthenticated

access to protected

paths. There is no control plane exposure; this is a data plane issue only.

Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2026-104939
https://my.f5.com/manage/s/article/K000162617
https://github.com/advisories/GHSA-qcp7-h72p-6whw