CVE-2026-77180: CWE-76 Improper Neutralization of Equivalent Special Elements in F5 NGINX Ingress Controller

The vulnerability arises because multiple user-controllable fields in Ingress annotations are written into the generated NGINX configuration without proper sanitization, allowing an authenticated attacker with write access to inject arbitrary NGINX configuration directives. This can lead to unauthorized creation or deletion of files or disabling of services within the control plane of the NGINX Ingress Controller. The issue is limited to the control plane and does not expose the data plane directly. The affected product is F5's NGINX Ingress Controller, specifically versions 5.0.0 and 2026-lts-r1. The CVSS v3.1 score is 8.3, indicating a high severity vulnerability. There is no information about an available patch or official remediation from the vendor at this time.

An authenticated attacker with permission to modify Ingress annotations via the Kubernetes API can inject arbitrary NGINX configuration directives, potentially leading to unauthorized file creation or deletion and service disruption within the control plane. There is no direct exposure of the data plane, limiting the scope of impact to control plane operations.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict write permissions to Ingress annotations to trusted users only to reduce the risk of exploitation.