CVE-2026-77180: 
NGINX Ingress Controller (NGINX Inc) vulnerability analysis and mitigation

CVE-2026-77180 is a configuration injection vulnerability in F5 NGINX Ingress Controller affecting versions 5.0.0 through 5.5.x (fixed in 5.6.0) and 2026-lts-r1 through 2026-lts-r4 (fixed in 2026-lts-r5). The flaw exists in the controller's configuration generator, where multiple user-controllable Ingress annotation fields are written into the generated NGINX configuration without sanitization, enabling authenticated attackers to inject arbitrary NGINX directives. It was published on September 2, 2026, with a CVSS v3.1 score of 8.3 (High) and a CVSS v4.0 score of 8.7 (High) (GitHub Advisory).

The root cause is classified as CWE-76 (Improper Neutralization of Equivalent Special Elements): user-supplied values in Kubernetes Ingress annotations are passed directly into the generated NGINX configuration template without adequate sanitization or escaping. An authenticated attacker with Kubernetes RBAC permissions to create or modify Ingress resources can craft annotation values containing arbitrary NGINX configuration directives, which are then rendered verbatim into the active NGINX configuration. The attack vector is network-based, requires low privileges (Kubernetes API write access to Ingress annotations), and no user interaction. This is strictly a control plane issue — the data plane (traffic proxying) is not directly exposed (GitHub Advisory).

A successful exploit allows an authenticated attacker to inject arbitrary NGINX configuration directives, potentially enabling them to create or delete files on the controller's filesystem, disable services, or manipulate routing and proxy behavior. Confidentiality and integrity impacts are rated High, while availability impact is Low. Because this is a control plane vulnerability, the blast radius is limited to the NGINX Ingress Controller itself and the Kubernetes cluster's ingress configuration — there is no direct data plane exposure to end-user traffic (GitHub Advisory).

As of the disclosure date, there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation (GitHub Advisory). The EPSS score is approximately 0.307% (23rd percentile), indicating a low near-term exploitation probability. The NVD SSVC assessment also classifies exploitation as "none" at this time. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.

1. Reconnaissance: Identify a target Kubernetes cluster running NGINX Ingress Controller versions 5.0.0–5.5.x or 2026-lts-r1 through 2026-lts-r4 using cluster metadata, Helm release listings, or exposed version endpoints.
2. Obtain Kubernetes API access: Acquire credentials or a service account token with RBAC permissions to create or modify Ingress resources in the target namespace (e.g., via a compromised developer account or misconfigured RBAC policy).
3. Craft malicious annotation: Construct a Kubernetes Ingress manifest with an annotation field containing an injected NGINX configuration directive — for example, embedding a newline followed by a malicious server block, include directive pointing to an attacker-controlled file, or a directive that disables a security feature.
4. Apply the malicious Ingress: Submit the crafted Ingress resource to the Kubernetes API using kubectl apply or a direct API call.
5. Trigger configuration reload: The NGINX Ingress Controller detects the Ingress change, regenerates the NGINX configuration incorporating the unsanitized annotation value, and reloads NGINX — activating the injected directive.
6. Achieve objective: Depending on the injected directive, the attacker may read sensitive files, write files to the controller filesystem, disable routing for specific services, or alter proxy behavior to intercept traffic (GitHub Advisory).

• Kubernetes API Logs: Audit log entries showing unexpected creation or modification of Ingress resources by low-privilege accounts or service accounts not normally associated with ingress management; look for CREATE or UPDATE events on ingresses resources in the Kubernetes audit log.
• Ingress Annotations: Ingress resources containing annotation values with unusual characters such as newlines (\n), semicolons, or NGINX directive keywords (e.g., include, server, location, access_log, deny, allow) embedded within annotation values.
• NGINX Configuration Files: Unexpected or malformed directives in the generated NGINX configuration (typically at /etc/nginx/nginx.conf or similar paths inside the controller pod); presence of include directives referencing non-standard paths.
• File System (Controller Pod): Unexpected files created or deleted within the NGINX Ingress Controller pod's filesystem, particularly in directories writable by the NGINX process.
• Logs (Controller): NGINX Ingress Controller logs showing configuration reload events (nginx -s reload) triggered by Ingress annotation changes, especially if followed by NGINX errors or unexpected behavior.

F5 has released patched versions: 5.6.0 (for the 5.x branch) and 2026-lts-r5 (for the LTS branch). Organizations should upgrade to these versions as the primary remediation (GitHub Advisory). As a workaround prior to patching, restrict Kubernetes RBAC permissions to limit which users and service accounts can create or modify Ingress resources and their annotations. Implement admission controllers or OPA/Gatekeeper policies to validate and reject Ingress annotations containing suspicious characters or patterns. Monitor Kubernetes audit logs for unexpected Ingress annotation modifications.