NGINX Ingress Controller CVE-2026-52865

The attacker must be an authenticated principal with Kubernetes RBAC write access (create or modify) to Ingress or TransportServer resources processed by the F5 NGINX Ingress Controller - this is the exact, concrete prerequisite reflected in CVSS PR:L. Exploitation is network-reachable and requires no user interaction (AV:N/UI:N). Limiting factors: the flaw cannot be triggered by an unauthenticated or read-only actor, so clusters that restrict Ingress/TransportServer write access to a small set of trusted operators are largely insulated; impact is availability-only (VA:H, VC:N/VI:N) and confined to the control plane with no data plane compromise. TransportServer is an NGINX-specific CRD, so deployments not using NGINX Ingress Controller's custom resources are out of scope.

The vendor CVSS 4.0 score is 7.1 (AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H) - network-reachable, low complexity, no user interaction, but requiring low privileges and yielding only availability impact. The privilege requirement (PR:L) is meaningful: the attacker must already hold Kubernetes RBAC permission to create or modify Ingress/TransportServer resources, so this is a post-authentication, likely multi-tenant or compromised-service-account threat rather than an internet-facing pre-auth flaw. No EPSS score, KEV listing, or public POC was provided, so exploitation-probability signals are absent; there is no public exploit identified at time of analysis and no evidence of active exploitation. Real-world priority is moderate: the crash-loop persistence amplifies impact for anyone who reaches the vulnerable resource types, but the RBAC gate substantially narrows the attacker population. In multi-tenant clusters where namespaced users define their own Ingress resources this is a genuine availability priority; in tightly controlled single-tenant clusters it is lower.

An attacker who has obtained a Kubernetes account with namespaced permission to create Ingress or TransportServer resources - for example a tenant in a shared cluster or a compromised CI/CD pipeline service account - submits a specially malformed resource. The NGINX Ingress Controller reads the object, hits the null pointer dereference, and crashes; because the resource remains in etcd, the controller crash-loops on every restart, denying ingress reconciliation cluster-wide. No public POC is currently identified.