CVE-2026-55723: 
NGINX Ingress Controller (NGINX Inc) vulnerability analysis and mitigation

CVE-2026-55723 is a configuration injection vulnerability in F5's NGINX Ingress Controller affecting its configuration generator when Custom Resource Definitions (CRDs) or Ingress annotations are in use. Multiple user-controllable fields are written into the generated NGINX configuration without sanitization, allowing an authenticated attacker with write access to CRDs or annotations to inject arbitrary NGINX configuration directives. Affected versions include 3.6.0–3.7.2, 4.0.0–4.0.1, 5.0.0–5.5.2 (fixed in 5.5.2), and the 2026-lts-r1 through 2026-lts-r3 LTS release track. The vulnerability was published on July 15, 2026, with a CVSS v4 base score of 8.7 (High) and a CVSS v3.1 base score of 8.3 (High) (GitHub Advisory, F5 Advisory).

The root cause is classified as CWE-76 (Improper Neutralization of Equivalent Special Elements): the NGINX Ingress Controller's configuration generator writes user-supplied values from Kubernetes CRDs and Ingress annotations directly into the generated NGINX configuration file without adequate sanitization or escaping. An authenticated attacker who has been granted write access to these Kubernetes resources via RBAC can craft malicious field values containing NGINX configuration directives (e.g., newline-injected directives or special characters that alter configuration block structure). The attack vector is network-based, requires low privileges (Kubernetes API write access to Ingress resources or CRDs), and no user interaction. This is strictly a control plane issue — the data plane (traffic forwarding) is not directly exposed (GitHub Advisory, F5 Advisory).

A successful exploit allows an authenticated attacker to inject arbitrary NGINX configuration directives into the controller's generated configuration, potentially enabling creation or deletion of files on the controller host, disabling services, or manipulating routing and proxy behavior. Confidentiality and integrity impacts are rated High, as an attacker could redirect traffic, expose sensitive configuration data, or alter access controls enforced by the ingress layer. Availability impact is rated Low, and there is no subsequent system (data plane) impact — the vulnerability is confined to the Kubernetes control plane (GitHub Advisory, F5 Advisory).

As of the time of publication, there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation (GitHub Advisory). The NVD SSVC assessment confirms exploitation status as "none" and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.29% (22nd percentile), indicating a low near-term exploitation probability. Exploitation requires authenticated access with Kubernetes RBAC write permissions to Ingress resources or CRDs, which limits the attacker pool but does not eliminate insider or compromised-credential threat scenarios.

1. Reconnaissance: Identify a target Kubernetes cluster running a vulnerable version of F5 NGINX Ingress Controller (3.6.0–3.7.2, 4.0.0–4.0.1, 5.0.0–<5.5.2, or 2026-lts-r1–<2026-lts-r3) using cluster version enumeration or public-facing metadata.
2. Obtain write access: Acquire Kubernetes credentials with RBAC permissions to create or modify Ingress resources or NGINX Ingress Controller CRDs (e.g., via a compromised service account, insider access, or misconfigured RBAC policy).
3. Craft malicious annotation or CRD field: Construct a Kubernetes Ingress manifest or CRD object containing a field value that embeds unsanitized NGINX configuration directives — for example, injecting newline characters followed by arbitrary nginx.conf directives (e.g., \ninclude /etc/passwd; or custom location blocks) into annotation values such as nginx.org/server-snippets or similar configurable fields.
4. Apply the malicious resource: Submit the crafted manifest to the Kubernetes API server using kubectl apply or equivalent API calls.
5. Trigger configuration reload: The NGINX Ingress Controller detects the resource change, regenerates the NGINX configuration incorporating the injected directives, and reloads NGINX — activating the attacker-controlled configuration.
6. Achieve objective: Depending on the injected directives, the attacker may redirect traffic, expose internal services, create or delete files accessible to the NGINX process, or disable specific ingress routes (GitHub Advisory, F5 Advisory).

• Kubernetes API Logs: Unexpected or unauthorized CREATE/UPDATE/PATCH operations on Ingress resources or NGINX Ingress Controller CRDs by non-administrative service accounts or users; audit log entries showing modifications to annotation fields such as nginx.org/server-snippets, nginx.org/location-snippets, or similar.
• NGINX Ingress Controller Logs: Configuration reload events (nginx -s reload) triggered shortly after suspicious Ingress or CRD modifications; error messages in the controller logs indicating unexpected configuration directives or failed configuration validation.
• File System: Unexpected files created or deleted in directories accessible to the NGINX process (e.g., /etc/nginx/, /tmp/); modification timestamps on NGINX configuration files correlating with suspicious Kubernetes API activity.
• Network: Unusual traffic routing changes — requests being proxied to unexpected upstream destinations; new location blocks or upstream definitions appearing in the active NGINX configuration that were not administratively authorized.
• Process: NGINX worker processes restarting unexpectedly; the ingress controller process executing file I/O operations outside its normal operational pattern.

F5 has released patched versions: 5.5.2 for the 5.x branch and 2026-lts-r3 for the LTS track; users on 3.6.0–3.7.2 and 4.0.0–4.0.1 should upgrade to a supported, patched release (F5 Advisory). As an immediate workaround, restrict write access to NGINX Ingress Controller CRDs and Ingress annotations using Kubernetes RBAC, limiting permissions to only trusted administrators. Additionally, implement Kubernetes admission controllers or policy engines (e.g., OPA/Gatekeeper, Kyverno) to validate and reject Ingress annotations containing suspicious characters such as newlines. Audit existing Ingress resources and CRDs for unexpected or anomalous annotation values as part of incident response.

The vulnerability received coverage from Field Effect's security blog, which highlighted it alongside other F5 NGINX and BIG-IP updates (Field Effect Blog). It was referenced in the CISA weekly vulnerability bulletin (SB26-201), indicating recognition by U.S. government cybersecurity authorities (CISA Bulletin). Social media activity was limited, with brief mentions on Mastodon security communities shortly after disclosure, consistent with the vulnerability's lack of public exploit code and its requirement for authenticated access.