CVE-2026-52865
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk20th percentile - higher than 20% of all known CVEs
Summary
A vulnerability in NGINX Ingress Controller allows an authenticated attacker with permissions to create or modify Ingress or TransportServer resources to terminate the controller process. This causes a persistent crash loop until the malformed resource is removed from the cluster.
Risk Assessment
The risk is a denial-of-service (DoS) attack on the NGINX Ingress Controller control plane, potentially disrupting applications relying on this controller. The data plane is not affected, but traffic management services may become unavailable.
Recommendation
Immediately update NGINX Ingress Controller to the latest patched version. Restrict permissions to create or modify Ingress and TransportServer resources to trusted users only.
Other vulnerabilities in NGINX Ingress Controller
See all- CVE-2026-77180High
A vulnerability in NGINX Ingress Controller where the configuration generator does not sanitize user-controllable fields from Ingress annotations. An authenticated attacker with permission to create or modify these annotations can inject arbitrary NGINX configuration directives.
- CVE-2026-55723High
An injection vulnerability exists in NGINX Ingress Controller when configured with CRDs or Ingress annotations. An authenticated attacker with write access can inject arbitrary NGINX configuration directives.
Original NVD description (English source)
When NGINX Ingress Controller processes Ingress or TransportServer resources, an authenticated, remote attacker with permission to create or modify Ingress or TransportServer resources can cause the NGINX Ingress Controller process to terminate. Impact: The NGINX Ingress Controller control plane process terminates and enters a persistent crash loop while the malformed Ingress or TransportServer resource remains in the cluster. This vulnerability allows a remote, authenticated attacker with at least Ingress or TransportServer resource write access to cause a denial-of-service (DoS) on the NGINX Ingress Controller system. There is no data plane exposure; this is a control plane issue only. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.