Harbor Supervisor Service is Not Impacted by NGINX SSL Upstream Injection Vulnerability (CVE-2026-1642)

Products

• VMware vSphere Kubernetes Service

Issue/Introduction

A vulnerability known as NGINX Rift (CVE-2026-1642) exists in NGINX Open Source Software (OSS) and NGINX Plus when configured to proxy requests to upstream Transport Layer Security (TLS) servers.

Under specific circumstances, an attacker who has achieved a Man-in-the-Middle (MITM) network position between NGINX and its upstream backend servers—alongside other complex timing and environmental conditions—can exploit an architectural vulnerability in how NGINX parses upstream response strings. This allows the attacker to bypass protocol restrictions and inject plaintext data payloads into the response returned from an upstream proxied server, potentially leading to remote code execution (RCE) or information disclosure.

Security scanning software may flag the embedded container components or ingress vectors within the Harbor Supervisor Service ecosystem due to the presence of legacy NGINX structural definitions or dependency packages.

Environment

Harbor Supervisor Service

Cause

The vulnerability stems from an 18-year-old architectural flaw in how NGINX handles and constructs proxy buffers when communicating with upstream targets over TLS.

While third-party vulnerability scanners flag this CVE simply by detecting the NGINX package binary signature or container image versions matching the affected range ($1.3.0 < 1.28.2$ or $1.29.x < 1.29.5$), a successful exploit strictly requires:

1. NGINX to actively utilize an proxy_pass directive targeted at an encrypted upstream destination (https://).

2. An active Man-in-the-Middle (MITM) adversary sitting directly on the isolated network link between NGINX and that secure upstream backend server.

Resolution

The Harbor Supervisor Service is not impacted by CVE-2026-1642. The embedded NGINX architecture within the Harbor Supervisor Service package does not utilize the vulnerable upstream TLS proxy configuration patterns required to trigger this exploit. Additionally, the internal service endpoints communicate via private, cluster-isolated network namespaces that are structurally protected against the external Man-in-the-Middle (MITM) network visibility required by this attack vector.

No remediation or manual patching is required. The vulnerability scanner alerts can be safely classified as a false positive for this specific deployment model.

Additional Information

https://depthfirst.com/research/nginx-rift-achieving-nginx-rce-via-an-18-year-old-vulnerability