CVE-2026-77180
Description
A flaw was found in NGINX Ingress Controller. When configured with Ingress annotations, an injection vulnerability in the configuration generator allows an authenticated attacker with specific permissions to craft values that inject arbitrary NGINX configuration directives. This can enable the attacker to create or delete files, or disable services, impacting the control plane.
Statement
Red Hat has evaluated this vulnerability as having an Important severity because an authenticated user with permissions to define Ingress annotations can inject arbitrary directives into the generated web server configuration, potentially altering files or disrupting control plane functionality. Red Hat OpenShift is not affected by default as its standard cluster ingress relies on an HAProxy-based router rather than NGINX Ingress Controller. This flaw only poses a risk in environments where administrators have manually installed and exposed the standalone NGINX Ingress Controller and granted Ingress configuration rights to untrusted tenants.
Understanding the Weakness (CWE)
Access Control
Technical Impact: Bypass Protection Mechanism
In some cases, injectable code controls authentication; this may lead to a remote vulnerability.
Access Control
Technical Impact: Gain Privileges or Assume Identity
Injected code can access resources that the attacker is directly prevented from accessing.
Integrity,Confidentiality,Availability
Technical Impact: Execute Unauthorized Code or Commands
When a product allows a user's input to contain code syntax, it might be possible for an attacker to craft the code in such a way that it will alter the intended control flow of the product. As a result, code injection can often result in the execution of arbitrary code. Code injection attacks can also lead to loss of data integrity in nearly all cases, since the control-plane data injected is always incidental to data recall or writing.
Non-Repudiation
Technical Impact: Hide Activities
Often the actions performed by injected control code are unlogged.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
