CVE-2026-55723

Name of the Vulnerable Software and Affected Versions NGINX Ingress Controller (affected versions not specified)

Description An injection flaw exists in the configuration generator when the software is configured with Custom Resource Definitions (CRDs) or Ingress annotations. Multiple user-controllable fields are written into the generated NGINX configuration without proper sanitization. An authenticated attacker with permissions to create or modify these CRDs or annotations can inject arbitrary NGINX configuration directives. This control plane issue allows the attacker to create or delete files or disable services, although there is no data plane exposure.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.