CVE-2020-5901: F5 Nginx Controller

Critical severity, CVSS 9.6. EPSS: 1.5% chance of exploitation in the next 30 days.

In NGINX Controller 3.3.0-3.4.0, undisclosed API endpoints may allow for a reflected Cross Site Scripting (XSS) attack. If the victim user is logged in as admin this could result in a complete compromise of the system.

Affected products

• F5 Nginx Controller: from 3.3.0, up to and including 3.4.0

Published 2020-07-01. Last modified 2026-06-17.