CVEFinder.io

CVE-2026-55723

⚠️ high
Summary

When NGINX Ingress Controller is configured with Custom Resource Definitions (CRDs) or Ingress annotations, an injection vulnerability exists in the configuration generator of NGINX Ingress Controller. Multiple user-controllable fields are written into the generated NGINX configuration without sanitization. An authenticated attacker with permission to create or modify these CRDs or annotations may craft values that inject arbitrary NGINX configuration directives. Impact: An authenticated attac

Description

When NGINX Ingress Controller is configured with Custom Resource Definitions (CRDs) or Ingress annotations, an injection vulnerability exists in the configuration generator of NGINX Ingress Controller. Multiple user-controllable fields are written into the generated NGINX configuration without sanitization. An authenticated attacker with permission to create or modify these CRDs or annotations may craft values that inject arbitrary NGINX configuration directives.

Impact:
An authenticated attacker granted write access to NGINX Ingress Controller CRDs or Ingress annotations through the Kubernetes API may be able to inject arbitrary NGINX configuration directives, create or delete files, or disable services. There is no data plane exposure; this is a control plane issue only.

Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

CVSS Score
8.3
High
EPSS Score
0.3
Exploit Probability
Published Date
2026-07-15
First Seen: 2026-07-16
📊 Relative Risk Intelligence

This CVE is High Risk - more severe than 79.1% of all 365,890 vulnerabilities in our database.

#76,347
Top 25% most severe
Severity Percentile
🎯 CISA SSVC Assessment Updated: Jul 15, 2026
🔍 Exploitation Status
None
No known exploits
⚙️ Automatable
NO
Requires human interaction
💥 Technical Impact
Total
Complete system compromise possible
🏆 Discovered By
F5
SSVC data provided by CISA
Last Modified 2026-07-16
Source NVD 🔗
CVSS Vector 3.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L
CVSS Vector 4.0 CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CWE IDs (Weakness Types)
CWE-76

📦 Affected Products 3

Vendor Product Status Affected Versions
f5 nginx_ingress_controller Affected
> 3.6.0 < 3.7.2
f5 nginx_ingress_controller Affected
> 4.0.0 < 4.0.1
f5 nginx_ingress_controller Affected
> 5.0.0 < 5.5.2

🔗 References 1

https://my.f5.com/manage/s/article/K000161800
Mitigation Vendor Advisory

🔗 Related CVEs 6

CVE ID Severity CVSS EPSS Summary Published
CVE-2026-42533 ⚠️ high 8.1 3.5 A vulnerability exists in NGINX Plus and NGINX Open Source when a map directive uses regex matching and a string expres... 2026-07-15
CVE-2026-52865 🔶 medium 6.5 0.3 When NGINX Ingress Controller processes Ingress or TransportServer resources, an authenticated, remote attacker with per... 2026-07-15
CVE-2026-56434 🔶 medium 6.5 0.5 NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_ssi_module module. This vulnerability may exist w... 2026-07-15
CVE-2026-60065 ℹ️ low 3.7 0.3 When NGINX Plus is configured to use the Message Queuing Telemetry Transport (MQTT) filter module (ngx_stream_mqtt_filte... 2026-07-15
CVE-2026-60005 ⚠️ high 8.2 0.7 NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_slice_module module. When the slice directive and... 2026-07-15
CVE-2026-42055 ⚠️ high 8.1 6.5 NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_proxy_v2_module and ngx_http_grpc_module modules... 2026-06-17
These CVEs affect the same products