An injection vulnerability in the F5 NGINX Ingress Controller allows authenticated attackers with Kubernetes API access to execute unauthorized configuration changes, posing a significant control plane risk.

This is an improper neutralization of special elements (CWE-76) occurring within the configuration generator. An authenticated attacker with permissions to modify Ingress annotations can manipulate the generated NGINX configuration, potentially leading to unauthorized file operations or service disruption.

Successful exploitation allows an attacker to compromise the integrity of the NGINX Ingress Controller's control plane. With a CVSS score of 8.3, this high-severity flaw could lead to service outages or unauthorized configuration changes, significantly impacting the availability and security posture of the underlying Kubernetes environment.

Immediate Action: Upgrade to NGINX Ingress Controller version 5.6.0, 2026-lts-r5, or a later version as specified in the vendor advisory.

Proactive Monitoring: Audit Kubernetes RBAC policies to restrict access to Ingress annotations and monitor NGINX configuration logs for unexpected directive injections or unauthorized modifications.

Compensating Controls: Implement strict Kubernetes admission controllers to validate or mutate Ingress resources, preventing the submission of malicious or unauthorized annotation values.

Public Exploit Available: Unknown

This vulnerability represents a significant risk to the integrity of the ingress infrastructure. Administrators should prioritize patching the NGINX Ingress Controller within their Kubernetes clusters to the recommended versions. Given the requirement for authenticated access, organizations should also review and enforce the principle of least privilege for all identities interacting with the Kubernetes API.