CVE-2026-77180

F5 NGINX Ingress Controller contains a configuration injection flaw (CWE-76) in its configuration generator: when Ingress resources carry annotations, multiple user-controllable fields are written into the generated NGINX configuration without sanitization. An attacker who is authenticated to the Kubernetes API and has permission to create or modify these Ingress annotations can craft values that inject arbitrary NGINX configuration directives, create or delete files, or disable services. The issue is control plane only, with no data plane exposure, and deployments that use Ingress annotations are the ones affected. All supported releases are potentially exposed; the available data does not specify affected version ranges, and versions that have reached End of Technical Support (EoTS) are not evaluated. Exploitation is not currently known: EPSS gives a 0.3% probability of exploitation in the next 30 days, the flaw is not in CISA KEV, and no public proof-of-concept exists.

What to do: Upgrade NGINX Ingress Controller to the patched release identified in F5's security advisory (specific fixed version is not provided in the available data) and avoid running EoTS versions. In the meantime, restrict Kubernetes RBAC permissions to create or modify Ingress objects and their annotations to trusted principals, and audit existing annotations for embedded NGINX directive syntax such as newlines, semicolons, or braces.