CVE-2026-55723: 
NGINX Ingress Controller (NGINX Inc) vulnerability analysis and mitigation

CVE-2026-55723 is a configuration injection vulnerability in F5's NGINX Ingress Controller affecting its configuration generator when Custom Resource Definitions (CRDs) or Ingress annotations are in use. Multiple user-controllable fields are written into the generated NGINX configuration without sanitization, allowing an authenticated attacker with write access to CRDs or annotations to inject arbitrary NGINX configuration directives. Affected versions include 3.6.0–3.7.2, 4.0.0–4.0.1, 5.0.0–5.5.2 (fixed in 5.5.2), and the 2026-lts-r1 through 2026-lts-r3 LTS track. The vulnerability was published on July 15, 2026, with a CVSS v4.0 base score of 8.7 (High) and a CVSS v3.1 base score of 8.3 (High) (GitHub Advisory, F5 Advisory).

The root cause is classified as CWE-76 (Improper Neutralization of Equivalent Special Elements): the NGINX Ingress Controller's configuration generator writes user-supplied values from Kubernetes CRDs and Ingress annotations directly into the generated nginx.conf without adequate sanitization or escaping. An authenticated attacker who has been granted write access to these Kubernetes resources via RBAC can craft malicious field values containing NGINX configuration directives (e.g., injecting newlines or special characters to break out of expected configuration contexts). The attack vector is network-based, requires low privileges (Kubernetes API write access to Ingress/CRD resources), and no user interaction. This is strictly a control plane issue — the data plane (traffic forwarding) is not directly exposed (GitHub Advisory, F5 Advisory).

A successful exploit allows an authenticated attacker to inject arbitrary NGINX configuration directives into the controller's generated configuration, potentially enabling them to create or delete files on the controller host, disable services, or alter routing and proxy behavior. Confidentiality and integrity impacts are rated High, as sensitive configuration data could be exposed or manipulated; availability impact is rated Low. The scope is limited to the control plane — there is no direct data plane exposure — but manipulation of NGINX configuration could indirectly affect traffic handling for all services managed by the controller (GitHub Advisory, F5 Advisory).

1. Reconnaissance: Identify a target Kubernetes cluster running a vulnerable version of NGINX Ingress Controller (3.6.0–3.7.2, 4.0.0–4.0.1, or 5.0.0–5.5.2) using cluster enumeration tools or by querying the Kubernetes API for Ingress controller pod versions.
2. Obtain write access: Acquire or abuse Kubernetes credentials (e.g., a service account token or kubeconfig) that have create or update permissions on Ingress resources or relevant CRDs (e.g., VirtualServer, Policy) in the target namespace.
3. Craft malicious annotation or CRD field: Construct a Kubernetes Ingress annotation or CRD field value containing injected NGINX directives. For example, embed a newline character followed by an arbitrary NGINX directive (e.g., \nadd_header X-Injected true; or a directive to include an attacker-controlled config file) in a field such as nginx.org/server-snippets or similar snippet annotations.
4. Apply the malicious resource: Use kubectl apply or the Kubernetes API to create or update the Ingress resource or CRD with the crafted payload.
5. Trigger configuration reload: The NGINX Ingress Controller will detect the change, regenerate nginx.conf incorporating the injected directives, and reload NGINX — activating the attacker's configuration.
6. Achieve objective: Depending on the injected directives, the attacker may redirect traffic, expose sensitive upstream configuration, create or delete files accessible to the NGINX process, or disable specific services (GitHub Advisory, F5 Advisory).

• Kubernetes API Logs: Unexpected create or update events on Ingress resources or NGINX CRDs (e.g., VirtualServer, Policy) from unusual service accounts or users; audit log entries showing modifications to annotation fields containing newline characters or NGINX directive syntax.
• File System: Unexpected files created or deleted in directories accessible to the NGINX Ingress Controller process; modified or unfamiliar nginx.conf snippets containing directives not matching standard templates.
• Logs: NGINX Ingress Controller logs showing configuration reload events (nginx -s reload) triggered by Ingress/CRD changes at unusual times; NGINX error logs referencing unexpected configuration directives or include paths.
• Process/Network: Unusual outbound network connections from the NGINX Ingress Controller pod; unexpected NGINX worker process behavior such as serving unexpected responses or headers not defined in legitimate Ingress rules.

F5 has released patched versions: 5.5.2 for the 5.x branch and 2026-lts-r3 for the LTS track; users on 3.6.0–3.7.2 and 4.0.0–4.0.1 should upgrade to a supported, patched release (F5 Advisory). As an immediate workaround, restrict write access to NGINX Ingress Controller CRDs and Ingress annotations using Kubernetes RBAC, limiting permissions to only trusted administrators. Additionally, implement Kubernetes audit logging to monitor and alert on modifications to Ingress resources and CRDs, and apply network policies to limit access to the Kubernetes API server from untrusted principals (GitHub Advisory).

The vulnerability received coverage in the security community shortly after disclosure on July 15, 2026, with mentions on Mastodon and infosec-focused social platforms. Field Effect published a blog post covering F5 updates including this vulnerability (Field Effect Blog). CISA included it in a weekly vulnerability bulletin (CISA Bulletin). General community sentiment reflects moderate concern given the authenticated-only attack requirement, though the potential for control plane manipulation in Kubernetes environments is noted as significant for multi-tenant clusters.