The vulnerability arises because multiple user-controllable fields in CRDs or Ingress annotations are written into the generated NGINX configuration without proper sanitization, allowing an authenticated attacker with write permissions to inject arbitrary NGINX configuration directives. This can lead to creation or deletion of files or disabling of services within the control plane of the NGINX Ingress Controller. The issue does not impact the data plane. The vulnerability is identified as CWE-76 (Improper Neutralization of Equivalent Special Elements) and has a CVSS v3.1 score of 8.3, indicating high severity. No official patch or remediation level has been provided as of the published date.

An authenticated attacker with write access to NGINX Ingress Controller CRDs or Ingress annotations via the Kubernetes API can inject arbitrary NGINX configuration directives. This may allow the attacker to create or delete files or disable services within the control plane. There is no direct impact on the data plane, limiting the scope of the attack to control plane operations.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict write permissions to CRDs and Ingress annotations in the Kubernetes API to trusted users only to reduce the risk of exploitation.