Is CVE-2026-55723 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-55723 being exploited in the wild.

How severe is CVE-2026-55723?

High severity, with a CVSS score of 8.3, published 15 July 2026.

Which products and versions are affected?

F5 Nginx Ingress Controller 5.0.0 to 5.5.1, 2026-lts-r1 to 2026-lts-r2.

Is there a fix for CVE-2026-55723?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-55723 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-55723?

Check whether you run F5 Nginx Ingress Controller at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-55723: F5 NGINX Ingress Controller configuration injection in CRDs and annotations

CVE-2026-55723 · Severity: high · CVSS 8.3 · Published 2026-07-15

F5 NGINX Ingress Controller, a tool used to manage external access to services in a Kubernetes cluster, is vulnerable to a configuration injection flaw. An authorized user with permission to modify specific settings could inject malicious commands into the system's configuration. This could allow an attacker to create or delete files, disable services, or disrupt operations within the management layer of the network.

Technologies: F5 Nginx Ingress Controller. Vendors: F5.

Quick answers

Is CVE-2026-55723 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-55723 being exploited in the wild.
How severe is CVE-2026-55723?: High severity, with a CVSS score of 8.3, published 15 July 2026.
Which products and versions are affected?: F5 Nginx Ingress Controller 5.0.0 to 5.5.1, 2026-lts-r1 to 2026-lts-r2.
Is there a fix for CVE-2026-55723?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-55723 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-55723?: Check whether you run F5 Nginx Ingress Controller at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An injection vulnerability exists in the configuration generator of the F5 NGINX Ingress Controller when using Custom Resource Definitions (CRDs) or Ingress annotations. The root cause is the lack of sanitization for multiple user-controllable fields before they are written into the generated NGINX configuration (CWE-76). An authenticated attacker with Kubernetes API write access to these resources can craft values to inject arbitrary NGINX directives, potentially leading to file manipulation or service denial. This is a control plane issue and does not directly expose the data plane. The vulnerability is addressed in versions 5.5.2 and 2026-lts-r3.

Affected products

F5 NGINX Ingress Controller 5.0.0 to 5.5.1, 2026-lts-r1 to 2026-lts-r2

Timeline

2026-07-15: advisory: Initial publication of CVE-2026-55723 by F5 Networks

References

https://my.f5.com/manage/s/article/K000161800

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.