CVE-2026-52865: NGINX Ingress Controller vulnerability
When NGINX Ingress Controller processes Ingress or TransportServer resources, an authenticated, remote attacker with permission to create or modify Ingress or TransportServer resources can cause the NGINX Ingress Controller process to terminate.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 5.5.2
Event History
Frequently Asked Questions
What is the severity of CVE-2026-52865?
The severity of CVE-2026-52865 is medium with a CVSS score of 6.5.
What kind of impact can CVE-2026-52865 have?
CVE-2026-52865 can lead to the termination of the NGINX Ingress Controller process, affecting the control plane.
Who is affected by CVE-2026-52865?
CVE-2026-52865 affects authenticated remote attackers with permissions to create or modify Ingress or TransportServer resources.
How do I fix CVE-2026-52865?
To fix CVE-2026-52865, ensure that your NGINX Ingress Controller is updated to the latest version where the vulnerability is patched.
What type of vulnerability is CVE-2026-52865 classified as?
CVE-2026-52865 is classified as a Null Pointer Dereference vulnerability.