CVE-2026-55723: NGINX Ingress Controller vulnerability
When NGINX Ingress Controller is configured with Custom Resource Definitions (CRDs) or Ingress annotations, an injection vulnerability exists in the configuration generator of NGINX Ingress Controller. Multiple user-controllable fields are written into the generated NGINX configuration without sanitization. An authenticated attacker with permission to create or modify these CRDs or annotations may craft values that inject arbitrary NGINX configuration directives.
Impact: An authenticated attacker granted write access to NGINX Ingress Controller CRDs or Ingress annotations through the Kubernetes API may be able to inject arbitrary NGINX configuration directives, create or delete files, or disable services. There is no data plane exposure; this is a control plane issue only.
Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Restrict access to Kubernetes API endpoints that allow authenticated users to create/modify NGINX Ingress Controller CRDs and Ingress annotations (e.g., use RBAC to ensure only trusted service accounts can edit these resources/annotations).
Event History
Frequently Asked Questions
What is the severity of CVE-2026-55723?
The severity of CVE-2026-55723 is rated as high with a score of 8.7.
How do I fix CVE-2026-55723?
To mitigate CVE-2026-55723, ensure that NGINX Ingress Controller is configured without user-controllable fields in the configuration.
What software is affected by CVE-2026-55723?
CVE-2026-55723 affects the F5 NGINX Ingress Controller and the NGINX NGINX Ingress Controller.
What type of vulnerability is CVE-2026-55723?
CVE-2026-55723 is an injection vulnerability related to the NGINX Ingress Controller's configuration generator.
When was CVE-2026-55723 published?
CVE-2026-55723 was published on July 15, 2026.