CVE-2026-55723

Katalog CVE

CVSS 8.3 · High EPSS 0,51%

Kerentanan Improper Neutralization of Equivalent Special Elements pada f5 nginx ingress controller. Skor CVSS 3.1 8.3 (High) menurut f5.com.

Deskripsi (NVD)

When NGINX Ingress Controller is configured with Custom Resource Definitions (CRDs) or Ingress annotations, an injection vulnerability exists in the configuration generator of NGINX Ingress Controller. Multiple user-controllable fields are written into the generated NGINX configuration without sanitization. An authenticated attacker with permission to create or modify these CRDs or annotations may craft values that inject arbitrary NGINX configuration directives. Impact: An authenticated attacker granted write access to NGINX Ingress Controller CRDs or Ingress annotations through the Kubernetes API may be able to inject arbitrary NGINX configuration directives, create or delete files, or disable services. There is no data plane exposure; this is a control plane issue only. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Rincian

Terbit di NVD

15 Juli 2026

Terakhir diubah

16 Juli 2026

Status NVD

Analyzed

CVSS 3.1

8.3 (High), sumber f5.com
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-76: Improper Neutralization of Equivalent Special Elements

EPSS (30 hari)

0,51% peluang dieksploitasi; lebih tinggi dari 41,8% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://my.f5.com/manage/s/article/K000161800 mitigasi · advisory vendor