The NGINX Ingress Controller builds its configuration from data provided in Custom Resource Definitions or Ingress annotations. Because this data is inserted into the generated NGINX configuration without sanitization, a malicious input can inject extra NGINX directives. This does not affect the data plane directly, but the attacker can create or delete files, disable services, or otherwise manipulate the control plane configuration.

The vulnerability applies to the F5 NGINX Ingress Controller. Any deployed instance that allows creation or modification of CRDs or Ingress annotations is susceptible; specific version information is not supplied.

The CVSS score of 8.7 indicates high severity, while the EPSS score of less than 1% suggests that, at present, the likelihood of exploitation is low. The vulnerability is not listed in CISA’s KEV catalog. Exploitation requires an authenticated attacker with sufficient RBAC permissions to modify CRDs or annotations via the Kubernetes API, making the likely vector the control‑plane API.