CVE-2026-77180 in NGINX Ingress Controller
Summary
by MITRE • 09/02/2026
When NGINX Ingress Controller is configured with Ingress annotations, an injection vulnerability exists in the configuration generator of NGINX Ingress Controller. Multiple user-controllable fields are written into the generated NGINX configuration without sanitization. An authenticated attacker with permission to create or modify these annotations may craft values that inject arbitrary NGINX configuration directives.
Impact: An authenticated attacker granted write access to NGINX Ingress Controller Ingress annotations through the Kubernetes API may be able to inject arbitrary NGINX configuration directives, create or delete files, or disable services. There is no data plane exposure; this is a control plane issue only.
Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/02/2026
The vulnerability described constitutes a critical injection flaw within the NGINX Ingress Controller, specifically targeting its configuration generation mechanism when processing Kubernetes Ingress annotations. This security issue arises from insufficient input validation and sanitization procedures applied to user-controllable fields before they are integrated into the final NGINX server block configurations. The core technical failure lies in the controller's ability to accept arbitrary strings within annotation values without verifying their structural integrity or restricting them to a safe subset of directives. Consequently, an attacker who has obtained authenticated access with permissions to create or modify Ingress resources can manipulate these annotations to inject malicious configuration snippets directly into the NGINX process context. This represents a classic case of improper neutralization of special elements used in an OS command or configuration file, aligning closely with CWE-77 which covers generic injection vulnerabilities and CWE-94 regarding code injection through insufficient sanitization of user input.
From an operational perspective, the impact of this vulnerability is severe due to the high privileges typically held by NGINX processes running within Kubernetes clusters. Although the description notes that there is no direct data plane exposure, meaning external traffic cannot directly exploit this flaw without prior authentication and authorization, the control plane implications are profound. An authenticated attacker with write access can inject directives such as those allowing file system operations or service management commands embedded within NGINX configuration blocks. This capability enables the creation of arbitrary files on the underlying host node where the controller is deployed, potentially leading to unauthorized data exfiltration, persistence mechanisms via malicious scripts, or complete denial of service by disabling critical network services managed by the ingress controller. The absence of a direct attack vector from the internet does not mitigate the risk for internal threats or compromised service accounts with broad permissions within the cluster namespace.
The exploitation path typically involves leveraging Kubernetes RBAC policies to gain write access to Ingress resources, followed by crafting specific annotation values that contain malicious NGINX directives. These might include commands like add_header, proxy_pass, or even more dangerous constructs if supported by the version in question, which could interact with underlying system binaries depending on how the controller executes configuration reloads. This behavior maps directly to MITRE ATT&CK technique T1505.003, known as Server Software Component, where attackers install backdoors or other persistent components via legitimate software features. Furthermore, it relates to T1496 which involves resource hijacking for cryptomining or other malicious purposes if the injected configuration allows access to internal resources or initiates outbound connections to attacker-controlled servers.
Mitigation strategies must focus on both immediate remediation and long-term architectural hardening. The primary defense is upgrading NGINX Ingress Controller to a version that includes patches addressing this specific injection vulnerability, ensuring that input sanitization logic properly restricts annotation values to expected formats. Administrators should also enforce strict Role-Based Access Control within Kubernetes clusters, adhering to the principle of least privilege by limiting who can modify Ingress resources and their associated annotations. Implementing admission controllers such as OPA Gatekeeper or Kyverno can provide an additional layer of validation by rejecting any Ingress objects containing annotation values that match patterns indicative of injection attempts. Regular auditing of RBAC policies and continuous monitoring for anomalous configuration changes are essential to detect potential exploitation activities early, thereby maintaining the integrity of the control plane infrastructure.