GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration
Common Weakness Enumeration

CWE-76

Allowed

Improper Neutralization of Equivalent Special Elements

Abstraction: Base · Status: Draft

API response cwe.mitre.org

The product correctly neutralizes certain special elements, but it improperly neutralizes equivalent special elements.

28 vulnerabilities reference this CWE, most recent first.

GHSA-94X9-2XMH-58P8

Vulnerability from github – Published: 2026-09-02 18:32 – Updated: 2026-09-02 18:32
VLAI
Details

Description: When NGINX Plus is configured as the data plane for NGINX Gateway Fabric, an injection vulnerability exists in the NGINX configuration generator component of NGINX Gateway Fabric. User-supplied string values from the Authentication Filter Custom Resource Definition clientID or cookieName fields, or in the clientSecret field of a Secret referenced by an Authentication Filter, are rendered directly into NGINX configuration templates without sanitization or escaping.

Impact: An authenticated attacker with permission to create or modify these resources may craft values that inject arbitrary NGINX configuration directives. This is a control plane issue; there is no data plane exposure.

Severity
8.1 (High)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
8.6 (High)
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2026-66362"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-76"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-09-02T16:17:18Z",
    "severity": "HIGH"
  },
  "details": "Description:\nWhen NGINX Plus is configured as the data plane for NGINX Gateway Fabric, an injection vulnerability exists in the NGINX configuration generator component of NGINX Gateway Fabric. User-supplied string values from the Authentication Filter Custom Resource Definition clientID or cookieName fields, or in the clientSecret field of a Secret referenced by an Authentication Filter, are rendered directly into NGINX configuration templates without sanitization or escaping. \n\nImpact:\nAn authenticated attacker with permission to create or modify these resources may craft values that inject arbitrary NGINX configuration directives. This is a control plane issue; there is no data plane exposure.",
  "id": "GHSA-94x9-2xmh-58p8",
  "modified": "2026-09-02T18:32:11Z",
  "published": "2026-09-02T18:32:11Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-66362"
    },
    {
      "type": "WEB",
      "url": "https://my.f5.com/manage/s/article/K000162600"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

GHSA-9566-3H6W-56PP

Vulnerability from github – Published: 2026-06-17 18:35 – Updated: 2026-07-02 21:32
VLAI
Details

When NGINX Plus is configured as the data plane for NGINX Gateway Fabric, an injection vulnerability exists in the NGINX configuration generator component of NGINX Gateway Fabric. User-supplied string values from the NginxProxy Custom Resource Definition serverTokens field and the AuthenticationFilter Custom Resource Definition extraAuthArgs field are rendered directly into NGINX configuration templates without sanitization or escaping. An authenticated attacker with permission to create or modify these Custom Resource Definitions may craft values that inject arbitrary NGINX configuration directives. This is a control plane issue; there is no data plane exposure from the vulnerability trigger itself.

Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Severity
8.1 (High)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
8.6 (High)
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2026-11311"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-74",
      "CWE-76"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-06-17T15:16:42Z",
    "severity": "HIGH"
  },
  "details": "When NGINX Plus is configured as the data plane for NGINX Gateway Fabric, an injection vulnerability exists in the NGINX configuration generator component of NGINX Gateway Fabric. User-supplied string values from the NginxProxy\u00a0Custom Resource Definition serverTokens\u00a0field and the AuthenticationFilter\u00a0Custom Resource Definition extraAuthArgs\u00a0field are rendered directly into NGINX configuration templates without sanitization or escaping. An authenticated attacker with permission to create or modify these Custom Resource Definitions may craft values that inject arbitrary NGINX configuration directives. This is a control plane issue; there is no data plane exposure from the vulnerability trigger itself. \n\n\nNote: Software versions which have reached End of Technical Support (EoTS) are not evaluated.",
  "id": "GHSA-9566-3h6w-56pp",
  "modified": "2026-07-02T21:32:03Z",
  "published": "2026-06-17T18:35:55Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-11311"
    },
    {
      "type": "WEB",
      "url": "https://my.f5.com/manage/s/article/K000161611"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

GHSA-CG4G-M8JX-VJV2

Vulnerability from github – Published: 2026-07-30 16:26 – Updated: 2026-07-30 21:23
VLAI
Summary
dssrf has an SSRF bypass with remove_at_symbol_in_string
Details

Summary

is_url_safe in v1.0.3 contains an SSRF bypass. remove_at_symbol_in_string is applied to the raw URL string before new URL() parses it. This strips the @ that separates userinfo from host, corrupting the hostname so internal IPs are never checked.

Vulnerability

In helpers.ts, is_url_safe does:

u = remove_at_symbol_in_string(u);   // strips ALL '@' from the raw string
// ...
const parsed = new URL(u);
const hostname = parsed.hostname;    // resolved from the corrupted string

What happens step by step

Input: http://evil.com@127.0.0.1/

  1. remove_at_symbol_in_string → http://evil.com127.0.0.1/
  2. new URL(...) → hostname = "evil.com127.0.0.1"
  3. Not a bare IP, not IPv6 → passes all IP checks
  4. is_hostname_resolve_to_internal_ip("evil.com127.0.0.1") → NXDOMAIN → returns false
  5. Result: true (safe) — but any HTTP client using the original URL connects to 127.0.0.1

Proof of Concept

import nock from 'nock';
import { got } from 'got';
import { is_url_safe } from 'dssrf';

// Simulate an internal server at 10.0.0.1 that returns secret data
nock('http://10.0.0.1:80').persist().get('/').reply(200, 'SECRET_DATA');

const BYPASS_URL = 'http://2@10.0.0.1/';
const PLAIN_URL  = 'http://10.0.0.1/';

// dssrf should block both — it only blocks the plain one
console.log('--- dssrf validator ---');
console.log(`is_url_safe('${PLAIN_URL}')   =`, await is_url_safe(PLAIN_URL),  '← correctly blocked');
console.log(`is_url_safe('${BYPASS_URL}') =`, await is_url_safe(BYPASS_URL), '← ⚠️  BYPASSED (should be false)');

// HTTP client with the bypass URL — gets SECRET_DATA back from 10.0.0.1
console.log('\n--- HTTP client ---');
try {
  const res = await got(BYPASS_URL, { retry: { limit: 0 } });
  console.log(`got('${BYPASS_URL}') response:`, res.body, '← ⚠️  VULNERABLE');
} catch (e) {
  console.log(`got('${BYPASS_URL}') blocked:`, e.message);
}

Root Cause

@ in a URL separates userinfo (credentials) from host. Stripping it from the raw string before parsing destroys that boundary. The fix is to reject any URL that contains a userinfo component after parsing.

Suggested Fix

Remove the remove_at_symbol_in_string call from is_url_safe and add a userinfo check after new URL():

const parsed = new URL(u);

// Reject userinfo — '@' in authority is a classic SSRF bypass vector
if (parsed.username !== "" || parsed.password !== "") {
  return false;
}

A working patch verified against 15 vectors (all internal IPv4 ranges, IMDS, IPv6 via userinfo, and legitimate public URLs) is ready to submit as a PR.

Impact

  • Affected version: 1.0.3 (latest)
  • Bypasses: all internal IPv4 ranges, IPv6 loopback/ULA/link-local, AWS IMDS (169.254.169.254), any internal hostname via userinfo prefix
  • Note: The GHSA-8p33-q827-ghj5 advisory patched version (1.0.3) should be updated since this vector was not covered by that fix

Users are strongly advised to upgrade to dssrf 1.0.4

Severity
8.7 (High)
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 1.0.3"
      },
      "package": {
        "ecosystem": "npm",
        "name": "dssrf"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.0.4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-54722"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-76"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-07-30T16:26:52Z",
    "nvd_published_at": "2026-07-30T17:16:33Z",
    "severity": "HIGH"
  },
  "details": "## Summary\n\n`is_url_safe` in v1.0.3 contains an SSRF bypass. `remove_at_symbol_in_string` is applied to the raw URL string **before** `new URL()` parses it. This strips the `@` that separates userinfo from host, corrupting the hostname so internal IPs are never checked.\n\n## Vulnerability\n\nIn `helpers.ts`, `is_url_safe` does:\n\n```ts\nu = remove_at_symbol_in_string(u);   // strips ALL \u0027@\u0027 from the raw string\n// ...\nconst parsed = new URL(u);\nconst hostname = parsed.hostname;    // resolved from the corrupted string\n```\n\n### What happens step by step\n\nInput: `http://evil.com@127.0.0.1/`\n\n1. `remove_at_symbol_in_string` \u2192 `http://evil.com127.0.0.1/`\n2. `new URL(...)` \u2192 `hostname = \"evil.com127.0.0.1\"`\n3. Not a bare IP, not IPv6 \u2192 passes all IP checks\n4. `is_hostname_resolve_to_internal_ip(\"evil.com127.0.0.1\")` \u2192 NXDOMAIN \u2192 returns false\n5. **Result: `true` (safe)** \u2014 but any HTTP client using the *original* URL connects to `127.0.0.1`\n\n### Proof of Concept\n\n```js\nimport nock from \u0027nock\u0027;\nimport { got } from \u0027got\u0027;\nimport { is_url_safe } from \u0027dssrf\u0027;\n\n// Simulate an internal server at 10.0.0.1 that returns secret data\nnock(\u0027http://10.0.0.1:80\u0027).persist().get(\u0027/\u0027).reply(200, \u0027SECRET_DATA\u0027);\n\nconst BYPASS_URL = \u0027http://2@10.0.0.1/\u0027;\nconst PLAIN_URL  = \u0027http://10.0.0.1/\u0027;\n\n// dssrf should block both \u2014 it only blocks the plain one\nconsole.log(\u0027--- dssrf validator ---\u0027);\nconsole.log(`is_url_safe(\u0027${PLAIN_URL}\u0027)   =`, await is_url_safe(PLAIN_URL),  \u0027\u2190 correctly blocked\u0027);\nconsole.log(`is_url_safe(\u0027${BYPASS_URL}\u0027) =`, await is_url_safe(BYPASS_URL), \u0027\u2190 \u26a0\ufe0f  BYPASSED (should be false)\u0027);\n\n// HTTP client with the bypass URL \u2014 gets SECRET_DATA back from 10.0.0.1\nconsole.log(\u0027\\n--- HTTP client ---\u0027);\ntry {\n  const res = await got(BYPASS_URL, { retry: { limit: 0 } });\n  console.log(`got(\u0027${BYPASS_URL}\u0027) response:`, res.body, \u0027\u2190 \u26a0\ufe0f  VULNERABLE\u0027);\n} catch (e) {\n  console.log(`got(\u0027${BYPASS_URL}\u0027) blocked:`, e.message);\n}\n```\n\n## Root Cause\n\n`@` in a URL separates `userinfo` (credentials) from `host`. Stripping it from the raw string before parsing destroys that boundary. The fix is to **reject any URL that contains a userinfo component** after parsing.\n\n## Suggested Fix\n\nRemove the `remove_at_symbol_in_string` call from `is_url_safe` and add a userinfo check after `new URL()`:\n\n```ts\nconst parsed = new URL(u);\n\n// Reject userinfo \u2014 \u0027@\u0027 in authority is a classic SSRF bypass vector\nif (parsed.username !== \"\" || parsed.password !== \"\") {\n  return false;\n}\n```\n\nA working patch verified against 15 vectors (all internal IPv4 ranges, IMDS, IPv6 via userinfo, and legitimate public URLs) is ready to submit as a PR.\n\n## Impact\n\n- **Affected version**: 1.0.3 (latest)\n- **Bypasses**: all internal IPv4 ranges, IPv6 loopback/ULA/link-local, AWS IMDS (`169.254.169.254`), any internal hostname via userinfo prefix\n- **Note**: The GHSA-8p33-q827-ghj5 advisory patched version (`1.0.3`) should be updated since this vector was not covered by that fix\n\n\nUsers are strongly advised to upgrade to dssrf 1.0.4",
  "id": "GHSA-cg4g-m8jx-vjv2",
  "modified": "2026-07-30T21:23:13Z",
  "published": "2026-07-30T16:26:52Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/HackingRepo/dssrf-js/security/advisories/GHSA-cg4g-m8jx-vjv2"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54722"
    },
    {
      "type": "WEB",
      "url": "https://github.com/HackingRepo/dssrf-js/issues/97"
    },
    {
      "type": "WEB",
      "url": "https://github.com/HackingRepo/dssrf-js/pull/98"
    },
    {
      "type": "WEB",
      "url": "https://github.com/HackingRepo/dssrf-js/commit/9211f91bf532433a1a1b27d946571546a63664b3"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/HackingRepo/dssrf-js"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "dssrf has an SSRF bypass with remove_at_symbol_in_string"
}

GHSA-GMMM-PVV4-WW8G

Vulnerability from github – Published: 2024-03-14 06:31 – Updated: 2024-03-14 06:31
VLAI
Details

This vulnerability allows an already authenticated admin user to create a malicious payload that could be leveraged for remote code execution on the server hosting the PaperCut NG/MF application server.

Severity
7.2 (High)
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2024-1882"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-74",
      "CWE-76"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-03-14T04:15:08Z",
    "severity": "HIGH"
  },
  "details": "This vulnerability allows an already authenticated admin user to create a malicious payload that could be leveraged for remote code execution on the server hosting the PaperCut NG/MF application server.\n",
  "id": "GHSA-gmmm-pvv4-ww8g",
  "modified": "2024-03-14T06:31:58Z",
  "published": "2024-03-14T06:31:58Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-1882"
    },
    {
      "type": "WEB",
      "url": "https://www.papercut.com/kb/Main/Security-Bulletin-March-2024"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-H4RP-4MPV-G4RM

Vulnerability from github – Published: 2024-03-14 03:31 – Updated: 2024-03-14 03:31
VLAI
Details

This vulnerability potentially allows files on a PaperCut NG/MF server to be exposed using a specifically formed payload against the impacted API endpoint. The attacker must carry out some reconnaissance to gain knowledge of a system token. This CVE only affects Linux and macOS PaperCut NG/MF servers.

Severity
3.1 (Low)
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2024-1221"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-20",
      "CWE-76"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-03-14T03:15:06Z",
    "severity": "LOW"
  },
  "details": "This vulnerability potentially allows files on a PaperCut NG/MF server to be exposed using a specifically formed payload against the impacted API endpoint. The attacker must carry out some reconnaissance to gain knowledge of a system token. This CVE only affects Linux and macOS PaperCut NG/MF servers.\n",
  "id": "GHSA-h4rp-4mpv-g4rm",
  "modified": "2024-03-14T03:31:14Z",
  "published": "2024-03-14T03:31:14Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-1221"
    },
    {
      "type": "WEB",
      "url": "https://www.papercut.com/kb/Main/Security-Bulletin-March-2024"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-H5WQ-XQ9G-PPPC

Vulnerability from github – Published: 2023-03-02 06:30 – Updated: 2023-03-10 18:30
VLAI
Details

Improper Neutralization of Equivalent Special Elements in GitHub repository btcpayserver/btcpayserver prior to 1.8.0.

Severity
5.4 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2023-1149"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-76"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2023-03-02T05:15:00Z",
    "severity": "MODERATE"
  },
  "details": "Improper Neutralization of Equivalent Special Elements in GitHub repository btcpayserver/btcpayserver prior to 1.8.0.",
  "id": "GHSA-h5wq-xq9g-pppc",
  "modified": "2023-03-10T18:30:19Z",
  "published": "2023-03-02T06:30:14Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-1149"
    },
    {
      "type": "WEB",
      "url": "https://github.com/btcpayserver/btcpayserver/commit/ddb125f45892b4dafdbd5c072af1ce623758bb92"
    },
    {
      "type": "WEB",
      "url": "https://huntr.dev/bounties/2e734209-d7b0-4f57-a8be-c65c82208f2f"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-RQ28-44F4-Q58Q

Vulnerability from github – Published: 2026-09-02 18:32 – Updated: 2026-09-02 18:32
VLAI
Details

When NGINX Ingress Controller is configured with Ingress annotations, an injection vulnerability exists in the configuration generator of NGINX Ingress Controller. Multiple user-controllable fields are written into the generated NGINX configuration without sanitization. An authenticated attacker with permission to create or modify these annotations may craft values that inject arbitrary NGINX configuration directives.

Impact: An authenticated attacker granted write access to NGINX Ingress Controller Ingress annotations through the Kubernetes API may be able to inject arbitrary NGINX configuration directives, create or delete files, or disable services. There is no data plane exposure; this is a control plane issue only.

Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Severity
8.3 (High)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L
8.7 (High)
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2026-77180"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-76"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-09-02T16:17:23Z",
    "severity": "HIGH"
  },
  "details": "When NGINX Ingress Controller is configured with Ingress annotations, an injection vulnerability exists in the configuration generator of NGINX Ingress Controller. Multiple user-controllable fields are written into the generated NGINX configuration without sanitization. An authenticated attacker with permission to create or modify these annotations may craft values that inject arbitrary NGINX configuration directives. \n\nImpact:\nAn authenticated attacker granted write access to NGINX Ingress Controller Ingress annotations through the Kubernetes API may be able to inject arbitrary NGINX configuration directives, create or delete files, or disable services. There is no data plane exposure; this is a control plane issue only.\n\nNote: Software versions which have reached End of Technical Support (EoTS) are not evaluated.",
  "id": "GHSA-rq28-44f4-q58q",
  "modified": "2026-09-02T18:32:11Z",
  "published": "2026-09-02T18:32:11Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-77180"
    },
    {
      "type": "WEB",
      "url": "https://my.f5.com/manage/s/article/K000162601"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

GHSA-WXXQ-MWHH-CVM2

Vulnerability from github – Published: 2026-07-15 15:33 – Updated: 2026-07-15 15:33
VLAI
Details

When NGINX Ingress Controller is configured with Custom Resource Definitions (CRDs) or Ingress annotations, an injection vulnerability exists in the configuration generator of NGINX Ingress Controller. Multiple user-controllable fields are written into the generated NGINX configuration without sanitization. An authenticated attacker with permission to create or modify these CRDs or annotations may craft values that inject arbitrary NGINX configuration directives.

Impact: An authenticated attacker granted write access to NGINX Ingress Controller CRDs or Ingress annotations through the Kubernetes API may be able to inject arbitrary NGINX configuration directives, create or delete files, or disable services. There is no data plane exposure; this is a control plane issue only.

Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Severity
8.3 (High)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L
8.7 (High)
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2026-55723"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-76"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-07-15T15:16:45Z",
    "severity": "HIGH"
  },
  "details": "When NGINX Ingress Controller is configured with Custom Resource Definitions (CRDs) or Ingress annotations, an injection vulnerability exists in the configuration generator of NGINX Ingress Controller. Multiple user-controllable fields are written into the generated NGINX configuration without sanitization. An authenticated attacker with permission to create or modify these CRDs or annotations may craft values that inject arbitrary NGINX configuration directives. \n\nImpact:\nAn authenticated attacker granted write access to NGINX Ingress Controller CRDs or Ingress annotations through the Kubernetes API may be able to inject arbitrary NGINX configuration directives, create or delete files, or disable services. There is no data plane exposure; this is a control plane issue only.\n\nNote: Software versions which have reached End of Technical Support (EoTS) are not evaluated.",
  "id": "GHSA-wxxq-mwhh-cvm2",
  "modified": "2026-07-15T15:33:07Z",
  "published": "2026-07-15T15:33:07Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-55723"
    },
    {
      "type": "WEB",
      "url": "https://my.f5.com/manage/s/article/K000161800"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}
Mitigation
Requirements

Programming languages and supporting technologies might be chosen which are not subject to these issues.

Mitigation
Implementation

Utilize an appropriate mix of allowlist and denylist parsing to filter equivalent special element syntax from all input.

No CAPEC attack patterns related to this CWE.

← Back to the CWE list