CVE-2026-55723: nginx ingress controller from 3.6.0 (inclusive), through 3.7.2 (inclusive), from 4.0.0 (inclusive), through 4.0.1…

Affected technology

nginx ingress controller · from 3.6.0 (inclusive), through 3.7.2 (inclusive)
f5

nginx ingress controller · from 4.0.0 (inclusive), through 4.0.1 (inclusive)
f5

nginx ingress controller · from 5.0.0 (inclusive), before 5.5.2 (exclusive)
f5

NGINX Ingress Controller · 5.0.0 to before 5.5.2, 2026-lts-r1 to before 2026-lts-r3
F5

Component: Custom Resource Definitions, Ingress Annotations

Attack conditions (Vendor/CNA, CVSS 4.0): Network (remote) · Low privileges required · No user interaction required

What an attacker can do

An authenticated attacker with permission to create or modify these CRDs or annotations may craft values that inject arbitrary NGINX configuration directives. Vendor/CNA’s CVSS 4.0 assessment (base score 8.7/10) rates confidentiality and integrity impact as high; availability impact as low.