Which versions of NGINX Ingress Controller are affected by CVE-2026-55723?

F5 NGINX Ingress Controller is vulnerable to a configuration injection flaw (CVSS 8.7) that allows malicious modification of control-plane NGINX configuration.. A patch is available.

How to fix or mitigate CVE-2026-55723?

Within 24 hours: inventory all Kubernetes clusters running F5 NGINX Ingress Controller and document current version; identify users and service accounts with permissions to create or modify Ingress custom resources. Within 7 days: obtain and apply the vendor-released patch to all affected instances, testing in staging environment first. Within 30 days: audit RBAC policies to restrict Ingress CRD creation and modification to approved administrator accounts only, and verify all instances are running the patched version.

NGINX Ingress Controller CVE-2026-55723

Q: What is the CVSS score of CVE-2026-55723?

CVE-2026-55723 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-44680 HIGH

Improper Neutralization of Equivalent Special Elements (CWE-76)

2026-07-15 f5

GHSA-wxxq-mwhh-cvm2

Nginx Kubernetes Code Injection Nginx Ingress Controller Suse

8.7

CVSS 4.0 · Vendor: f5

Severity by source

Vendor (f5) PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

9.9 CRITICAL

Reachable over the Kubernetes API (AV:N) but requires ingress/CRD write privileges (PR:L); injected directives break the RBAC/tenant boundary into the controller, so S:C, with high confidentiality/integrity and limited availability impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N

SUSE

8.3 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L

Primary rating from Vendor (f5).

CVSS VectorVendor: f5

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Updated

Jul 15, 2026 - 15:28 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jul 15, 2026 - 15:22 vuln.today

cvss_changed

CVSS changed

Jul 15, 2026 - 15:22 NVD

8.3 (HIGH) 8.7 (HIGH)

Analysis Generated

Jul 15, 2026 - 15:21 vuln.today

CVE Published

Jul 15, 2026 - 14:33 cve.org

HIGH 8.3

DescriptionCVE.org

When NGINX Ingress Controller is configured with Custom Resource Definitions (CRDs) or Ingress annotations, an injection vulnerability exists in the configuration generator of NGINX Ingress Controller. Multiple user-controllable fields are written into the generated NGINX configuration without sanitization. An authenticated attacker with permission to create or modify these CRDs or annotations may craft values that inject arbitrary NGINX configuration directives.

Impact: An authenticated attacker granted write access to NGINX Ingress Controller CRDs or Ingress annotations through the Kubernetes API may be able to inject arbitrary NGINX configuration directives, create or delete files, or disable services. There is no data plane exposure; this is a control plane issue only.

Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Articles & Coverage 1

News 11 New Nginx Vulnerabilities - 1 Critical, 10 High Severity Jul 16, 2026

AnalysisAI

Configuration injection in F5 NGINX Ingress Controller lets an authenticated Kubernetes user with rights to create or modify Ingress CRDs or annotations smuggle arbitrary NGINX directives into the generated configuration. Because multiple user-controllable fields are written to the config without sanitization, an attacker can inject directives that create or delete files and disable services on the control plane. No public exploit identified at time of analysis; this is a control-plane-only issue with no data plane exposure, but the CVSS 4.0 score of 8.7 (High) reflects strong confidentiality and integrity impact.

Technical ContextAI

NGINX Ingress Controller is F5's Kubernetes ingress implementation that watches Ingress resources, Custom Resource Definitions (VirtualServer/VirtualServerRoute/TransportServer style CRDs), and Ingress annotations, then renders them into nginx.conf templates that the NGINX data plane loads. The flaw is CWE-76 (Improper Neutralization of Equivalent Special Elements): user-supplied values from CRD fields and annotations are templated directly into the generated NGINX configuration without escaping or validation, so an attacker can break out of the intended value context and add their own directives. Because NGINX configuration directives such as those in ngx_http_lua or file/log directives can execute powerful side effects, injected config translates into file creation/deletion and service disruption on the controller. The single affected product is identified by CPE cpe:2.3:a:f5:nginx_ingress_controller:*:*:*:*:*:*:*:*.

RemediationAI

Patch available per vendor advisory: F5 has released a fix, documented at https://my.f5.com/manage/s/article/K000161800 - apply the patched NGINX Ingress Controller release listed there (exact fixed version not enumerated in the provided data; confirm on the advisory). As the vulnerability requires write access to Ingress objects, CRDs, or annotations, the primary compensating control is to tighten Kubernetes RBAC so that only trusted operators can create or modify Ingress resources and the controller's CRDs, removing such permissions from tenant/namespace users; the trade-off is reduced self-service for application teams. Additionally, deploy an admission controller (e.g. OPA/Gatekeeper or Kyverno) to validate and reject CRD/annotation values containing NGINX config metacharacters or unexpected directives, accepting the operational overhead of maintaining those policies. Restrict who can reach the Kubernetes API with these permissions and audit existing RoleBindings for over-broad ingress write access.

More in Kubernetes

View all

CVE-2025-1974 CRITICAL Act Now POC

9.8 Mar 25

A critical vulnerability in Kubernetes ingress-nginx controller allows unauthenticated attackers with pod network access

CVE-2026-45321 CRITICAL Act Now POC

9.6 May 12

Credential-harvesting malware compromised 84 versions of 42 TanStack npm packages on 2026-05-11 via chained GitHub Actio

CVE-2025-1098 HIGH Act Now POC

8.8 Mar 25

Kubernetes ingress-nginx contains a configuration injection vulnerability via the mirror-target and mirror-host Ingress

CVE-2025-24514 HIGH Act Now POC

8.8 Mar 25

A security issue was discovered in ingress-nginx https://github.com/kubernetes/ingress-nginx where the `auth-url` Ingres

CVE-2025-1097 HIGH Act Now POC

8.8 Mar 25

A security issue was discovered in ingress-nginx https://github.com/kubernetes/ingress-nginx where the `auth-tls-match-c

CVE-2020-8554 MEDIUM This Month POC

6.3 Jan 21

Kubernetes API server in all versions allow an attacker who is able to create a ClusterIP service and set the spec.exter

CVE-2023-3676 HIGH Act Now POC

8.8 Oct 31

A security issue was discovered in Kubernetes where a user that can create pods on Windows nodes may be able to escalate

CVE-2025-55190 CRITICAL Act Now POC

9.9 Sep 04

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Rated critical severity (CVSS 9.9), this vulne

CVE-2026-34976 CRITICAL Act Now POC

10.0 Apr 02

Unauthenticated remote attackers can trigger complete database overwrites, server-side file reads, and SSRF attacks agai

CVE-2018-18843 CRITICAL Act Now POC

10.0 Dec 04

The Kubernetes integration in GitLab Enterprise Edition 11.x before 11.2.8, 11.3.x before 11.3.9, and 11.4.x before 11.4

CVE-2026-54680 CRITICAL Act Now POC

9.9 Jul 29

Fluentd configuration injection in the kube-logging Logging operator before 6.6.0 allows a namespace-scoped user who can

CVE-2026-22039 CRITICAL Act Now POC

9.9 Jan 27

Kyverno Kubernetes policy engine prior to 1.x has a privilege escalation vulnerability (CVSS 9.9) allowing policy bypass

Same weakness CWE-76 – Improper Neutralization of Equivalent Special Elements

View all

CVE-2024-2952 CRITICAL POC

9.8

CVE-2023-0493 HIGH POC

8.8

CVE-2026-54722 HIGH POC

8.7

CVE-2024-4897 HIGH POC

8.4

CVE-2024-34359 CRITICAL

9.6

CVE-2023-1149 MEDIUM POC

5.4

CVE-2026-11311 HIGH

8.6

CVE-2024-1882 HIGH

7.2

Same technique Code Injection

View all

CVE-2023-3519 CRITICAL POC

9.8

CVE-2021-22205 CRITICAL POC

10.0

CVE-2024-23692 CRITICAL POC

9.8

CVE-2012-0158 HIGH POC

8.8

CVE-2021-44529 CRITICAL POC

9.8

CVE-2014-6287 CRITICAL POC

9.8

CVE-2017-7494 CRITICAL POC

9.8

CVE-2025-24893 CRITICAL POC

9.8

Vendor StatusVendor

SUSE

Severity: Important

Product	Status
SUSE Linux Enterprise High Performance Computing 15 SP7	Affected
SUSE Linux Enterprise Module for Server Applications 15 SP7	Affected
SUSE Linux Enterprise Server 15 SP7	Affected
SUSE Linux Enterprise Server 16.1	Affected
SUSE Linux Enterprise Server for SAP Applications 15 SP7	Affected

CVE-2026-55723 vulnerability details – vuln.today

Back

NGINX Ingress Controller CVE-2026-55723

Severity by source

CVSS VectorVendor: f5

Lifecycle Timeline

DescriptionCVE.org

Articles & Coverage 1

AnalysisAI

Technical ContextAI

RemediationAI

More in Kubernetes

Same weakness CWE-76 – Improper Neutralization of Equivalent Special Elements

Same technique Code Injection

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code