High8.7F5

High [CVE-2026-55723] When NGINX Ingress Controller is configured with Custom Resource Definitions (CRDs) or Ingress annotations, an injection vulnerability exists in the configuration generator of NGINX Ingress Controller

This high-severity F5 advisory covers CVE-2026-55723 affecting NGINX Ingress Controller.

CVE-2026-55723 Published Jul 15, 2026Updated by vendor Jul 16, 2026

CVE-2026-55723

Affected products & platforms

F5NGINX

Open vendor advisory

Android app · Google Play

Monitor future F5 CVEs from your phone.

Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 32 official vendor sources and 160+ reviewed platform categories.

Matching phone alertsOptional email delivery

Get CVE alerts See app features

Summary

When NGINX Ingress Controller is configured with Custom Resource Definitions (CRDs) or Ingress annotations, an injection vulnerability exists in the configuration generator of NGINX Ingress Controller. Multiple user-controllable fields are written into the generated NGINX configuration without sanitization.

An authenticated attacker with permission to create or modify these CRDs or annotations may craft values that inject arbitrary NGINX configuration directives.

Impact: There is no data plane exposure; this is a control plane issue only.

Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Affected versions

NGINX Ingress Controller 5.0.0 before 5.5.2
NGINX Ingress Controller 2026-lts-r1 before 2026-lts-r3

Official advisory · high-confidence parse· fetched 2 months ago·verify at source

Fixed versions

5.5.2
2026-lts-r3

Official advisory · high-confidence parse· fetched 2 months ago·verify at source

Mitigation checklist

Temporary workarounds

Impact: An authenticated attacker granted write access to NGINX Ingress Controller CRDs or Ingress annotations through the Kubernetes API may be able to inject arbitrary NGINX configuration directives, create or delete files, or disable services.

Official advisory · high-confidence parse· fetched 2 months ago·verify at source

Discussion(0)

No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.