NGINX Ingress Controller can generate NGINX configuration files from user supplied Ingress annotations. The configuration generator fails to sanitize multiple user-controllable fields, allowing an attacker to inject arbitrary NGINX directives. This vulnerability can lead to the creation or deletion of files, disabling services, or other disruptive control‑plane actions. The weakness is a form of input‑validation flaw, identified as CWE‑76.

The affected product is F5's NGINX Ingress Controller. No specific version numbers are provided, so users should verify whether their deployment is within the affected set and check for any vendor patches or updates that address this issue.

The CVSS score of 8.7 indicates a high severity. The EPSS score is not available, but the absence of a KEV listing does not diminish the risk; the exploit requires an authenticated user with write access to Ingress annotations via the Kubernetes API, which is a realistic privilege for many cluster operators. Once gained, the attacker can inject arbitrary configuration directives into the control plane, potentially crippling services without affecting the data plane directly.