Executive brief
F5 NGINX Ingress Controller, a tool used to manage external access to services in a Kubernetes cluster, is vulnerable to a configuration injection flaw. An authorized user with permission to modify specific settings could inject malicious commands into the system's configuration. This could allow an attacker to create or delete files, disable services, or disrupt operations within the management layer of the network.
Technical details
An injection vulnerability exists in the configuration generator of the F5 NGINX Ingress Controller when using Custom Resource Definitions (CRDs) or Ingress annotations. The root cause is the lack of sanitization for multiple user-controllable fields before they are written into the generated NGINX configuration (CWE-76). An authenticated attacker with Kubernetes API write access to these resources can craft values to inject arbitrary NGINX directives, potentially leading to file manipulation or service denial. This is a control plane issue and does not directly expose the data plane. The vulnerability is addressed in versions 5.5.2 and 2026-lts-r3.
Affected products
- F5 NGINX Ingress Controller 5.0.0 to 5.5.1, 2026-lts-r1 to 2026-lts-r2
Timeline
- 2026-07-15: advisory: Initial publication of CVE-2026-55723 by F5 Networks