Which versions of NGINX Ingress Controller are affected by CVE-2026-52865?

F5 NGINX Ingress Controller contains a denial of service vulnerability (CVE-2026-52865) that allows authenticated attackers with resource write permissions to crash the Kubernetes control plane…. A patch is available.

How to fix or mitigate CVE-2026-52865?

Within 24 hours, inventory all F5 NGINX Ingress Controller deployments and document their versions against the vendor advisory for CVE-2026-52865. Within 7 days, apply the vendor-released patch to all affected instances and validate controller stability post-deployment. Within 30 days, audit and restrict RBAC write access to Ingress and TransportServer resources to only authorized cluster administrators, and implement audit logging on resource creation and modification events to detect future malformed submissions.

NGINX Ingress Controller CVE-2026-52865

Q: What is the CVSS score of CVE-2026-52865?

CVE-2026-52865 has a CVSS 4.0 base score of 7.1 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-44681 HIGH

NULL Pointer Dereference (CWE-476)

2026-07-15 f5

GHSA-gv6x-94m7-c6hh

Nginx Denial Of Service Null Pointer Dereference Nginx Ingress Controller Suse

7.1

CVSS 4.0 · Vendor: f5

Severity by source

Vendor (f5) PRIMARY

7.1 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.5 MEDIUM

Network-reachable with low complexity and no interaction, but requires RBAC write privileges (PR:L); impact is an availability-only crash loop, so C:N/I:N/A:H with scope unchanged.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

SUSE

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Primary rating from Vendor (f5).

CVSS VectorVendor: f5

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 15, 2026 - 15:31 vuln.today

Severity Changed

Jul 15, 2026 - 15:22 NVD

MEDIUM HIGH

CVSS changed

Jul 15, 2026 - 15:22 NVD

6.5 (MEDIUM) 7.1 (HIGH)

CVE Published

Jul 15, 2026 - 14:33 cve.org

HIGH 7.1

DescriptionCVE.org

When NGINX Ingress Controller processes Ingress or TransportServer resources, an authenticated, remote attacker with permission to create or modify Ingress or TransportServer resources can cause the NGINX Ingress Controller process to terminate.

Impact: The NGINX Ingress Controller control plane process terminates and enters a persistent crash loop while the malformed Ingress or TransportServer resource remains in the cluster. This vulnerability allows a remote, authenticated attacker with at least Ingress or TransportServer resource write access to cause a denial-of-service (DoS) on the NGINX Ingress Controller system. There is no data plane exposure; this is a control plane issue only.

Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Articles & Coverage 1

News 11 New Nginx Vulnerabilities - 1 Critical, 10 High Severity Jul 16, 2026

AnalysisAI

Denial of service in F5 NGINX Ingress Controller allows an authenticated remote attacker holding write access to Ingress or TransportServer resources to crash the control plane by submitting a malformed resource. Because the offending resource persists in the cluster, the controller re-reads it and re-crashes, producing a durable crash loop rather than a one-time outage. There is no public exploit identified at time of analysis, and impact is confined to the control plane with no data plane or confidentiality/integrity exposure.

Technical ContextAI

The affected component is the control plane of F5's NGINX Ingress Controller (CPE cpe:2.3:a:f5:nginx_ingress_controller), the Kubernetes controller that watches Ingress and TransportServer custom resources and translates them into NGINX configuration. The root cause is classified as CWE-476 (NULL Pointer Dereference): when the controller parses an attacker-supplied Ingress or TransportServer object, a code path dereferences a null pointer and the process aborts. Because the controller reconciles cluster state on a loop, the persisted malformed resource is repeatedly re-processed, converting a single crash into a persistent crash loop until the resource is manually removed. Note this is F5's commercial NGINX Ingress Controller, which is distinct from the separate community 'ingress-nginx' project.

RemediationAI

Patch available per vendor advisory - upgrade F5 NGINX Ingress Controller to the fixed release listed in F5 article K000161834 (https://my.f5.com/manage/s/article/K000161834); the exact fixed version is not enumerated in the provided data and must be taken from that advisory. As compensating controls until patching, tighten Kubernetes RBAC so that only trusted operators hold create/update permissions on Ingress and TransportServer resources, removing that access from untrusted or multi-tenant service accounts (trade-off: tenants lose self-service ingress configuration). Deploy a validating admission webhook or policy engine such as OPA/Gatekeeper or Kyverno to reject malformed Ingress/TransportServer specs before they persist, preventing the crash loop from being seeded (trade-off: added admission-path latency and policy maintenance). If a crash loop is already occurring, delete the offending malformed resource from the cluster to break the loop and restore the control plane.

More in Nginx Ingress Controller

View all

CVE-2023-44487 HIGH Act Now POC

7.5 Oct 10

Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour

CVE-2026-55723 HIGH This Week

8.7 Jul 15

Configuration injection in F5 NGINX Ingress Controller lets an authenticated Kubernetes user with rights to create or mo

CVE-2026-77180 HIGH This Week

8.7 Sep 02

Annotation injection in F5 NGINX Ingress Controller allows any authenticated Kubernetes principal with write access to I

CVE-2022-41741 HIGH This Week

7.8 Oct 19

NGINX Open Source before versions 1.23.2 and 1.22.1, NGINX Open Source Subscription before versions R2 P1 and R1 P1, and

CVE-2022-41742 HIGH This Week

7.1 Oct 19

NGINX Open Source before versions 1.23.2 and 1.22.1, NGINX Open Source Subscription before versions R2 P1 and R1 P1, and

CVE-2022-41743 HIGH This Week

7.0 Oct 19

NGINX Plus before versions R27 P1 and R26 P1 have a vulnerability in the module ngx_http_hls_module that might allow a l

CVE-2022-30535 MEDIUM This Month

6.5 Aug 04

In versions 2.x before 2.3.0 and all versions of 1.x, An attacker authorized to create or update ingress objects can obt

CVE-2026-1642 MEDIUM This Month

5.9 Feb 04

NGINX proxy configurations forwarding traffic to upstream TLS servers can be exploited by network-positioned attackers t

CVE-2024-10318 MEDIUM This Month

5.1 Nov 06

A session fixation issue was discovered in the NGINX OpenID Connect reference implementation, where a nonce was not chec

Same weakness CWE-476 – NULL Pointer Dereference

View all

CVE-2016-0742 HIGH

7.5

CVE-2014-3470 MEDIUM

4.3

CVE-2017-3730 HIGH POC

7.5

CVE-2017-3169 CRITICAL POC

9.8

CVE-2016-4957 HIGH

7.5

CVE-2015-3194 HIGH

7.5

CVE-2026-21525 MEDIUM

6.2

CVE-2017-0016 MEDIUM

5.9

Same technique Denial Of Service

View all

CVE-2015-5119 CRITICAL POC

9.8

CVE-2011-2462 CRITICAL POC

9.8

CVE-2011-0611 HIGH POC

8.8

CVE-2012-1889 HIGH POC

8.8

CVE-2012-0507 CRITICAL POC

9.8

CVE-2014-1761 HIGH POC

7.8

CVE-2015-5122 CRITICAL POC

9.8

CVE-2011-0609 HIGH POC

7.8

Vendor StatusVendor

SUSE

Severity: Moderate

Product	Status
SUSE Linux Enterprise High Performance Computing 15 SP7	Affected
SUSE Linux Enterprise Module for Server Applications 15 SP7	Affected
SUSE Linux Enterprise Server 15 SP7	Affected
SUSE Linux Enterprise Server 16.1	Affected
SUSE Linux Enterprise Server for SAP Applications 15 SP7	Affected

CVE-2026-52865 vulnerability details – vuln.today

Back

NGINX Ingress Controller CVE-2026-52865

Severity by source

CVSS VectorVendor: f5

Lifecycle Timeline

DescriptionCVE.org

Articles & Coverage 1

AnalysisAI

Technical ContextAI

RemediationAI

More in Nginx Ingress Controller

Same weakness CWE-476 – NULL Pointer Dereference

Same technique Denial Of Service

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code