F5 Nginx Ingress Controller vulnerabilities

28 CVEs affecting F5 Nginx Ingress Controller, 1 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-94197, published 2026-10-14.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2023-44487: HTTP/2 Rapid Reset Attack Vulnerability, published 2023-10-10. High severity, CVSS 7.5. Actively exploited: in CISA KEV since 2023-10-10. EPSS: 100% chance of exploitation in the next 30 days. The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.
CVE-2026-42055, published 2026-06-17. High severity, CVSS 8.1. EPSS: 6.5% chance of exploitation in the next 30 days. NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_proxy_v2_module and ngx_http_grpc_module modules. This vulnerability exists when the proxy_http_version to 2 or…
CVE-2026-42945, published 2026-05-13. High severity, CVSS 8.1. EPSS: 3.4% chance of exploitation in the next 30 days. NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_rewrite_module module. This vulnerability exists when the rewrite directive is followed by a rewrite, if, or set directive and an…
CVE-2026-9256, published 2026-05-22. High severity, CVSS 8.1. EPSS: 2.7% chance of exploitation in the next 30 days. NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_rewrite_module module. This vulnerability exists when a rewrite directive uses a regex pattern with distinct, overlapping…
CVE-2022-41742, published 2022-10-19. High severity, CVSS 7.1. EPSS: 1.2% chance of exploitation in the next 30 days. NGINX Open Source before versions 1.23.2 and 1.22.1, NGINX Open Source Subscription before versions R2 P1 and R1 P1, and NGINX Plus before versions R27 P1 and R26 P1 have a vulnerability in the…
CVE-2026-42530, published 2026-06-17. High severity, CVSS 8.1. EPSS: 1.1% chance of exploitation in the next 30 days. NGINX Open Source has a vulnerability in the ngx_http_v3_module module. When NGINX Open Source is configured to use the HTTP/3 QUIC module, a remote unauthenticated attacker along with conditions…
CVE-2026-42946, published 2026-05-13. High severity, CVSS 7.4. EPSS: 0.9% chance of exploitation in the next 30 days. A vulnerability exists in the ngx_http_scgi_module and ngx_http_uwsgi_module modules that may result in excessive memory allocation or an over-read of data. When scgi_pass or uwsgi_pass is…
CVE-2026-42533, published 2026-07-15. High severity, CVSS 8.1. EPSS: 0.9% chance of exploitation in the next 30 days. A vulnerability exists in NGINX Plus and NGINX Open Source when a map directive uses regex matching and a string expression references the map's regex capture variables before referencing the map…
CVE-2022-41741, published 2022-10-19. High severity, CVSS 7.8. EPSS: 0.8% chance of exploitation in the next 30 days. NGINX Open Source before versions 1.23.2 and 1.22.1, NGINX Open Source Subscription before versions R2 P1 and R1 P1, and NGINX Plus before versions R27 P1 and R26 P1 have a vulnerability in the…
CVE-2021-23055, published 2022-04-21. Medium severity, CVSS 6.5. EPSS: 0.8% chance of exploitation in the next 30 days. On version 2.x before 2.0.3 and 1.x before 1.12.3, the command line restriction that controls snippet use with NGINX Ingress Controller does not apply to Ingress objects. Note: Software versions…

Latest

CVE-2026-94197, published 2026-10-14. High severity, CVSS 7.5. EPSS: 0.4% chance of exploitation in the next 30 days. An authentication and authorization bypass vulnerability exists in F5 NGINX Kubernetes Ingress Controller (NIC) when configured with the `ExternalAuth` policy or Ingress external authentication.…
CVE-2026-104939, published 2026-10-14. High severity, CVSS 7.5. EPSS: 0.4% chance of exploitation in the next 30 days. Description NGINX Ingress Controller has a vulnerability when implementing an externalAuth policy for ingress. NGINX Ingress Controller may mishandle the HTTP response from an OAuth IdP and allow an…
CVE-2026-77180, published 2026-09-02. High severity, CVSS 8.3. EPSS: 0.5% chance of exploitation in the next 30 days. When NGINX Ingress Controller is configured with Ingress annotations, an injection vulnerability exists in the configuration generator of NGINX Ingress Controller. Multiple user-controllable fields…
CVE-2026-60005, published 2026-07-15. High severity, CVSS 8.2. EPSS: 0.5% chance of exploitation in the next 30 days. NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_slice_module module. When the slice directive and unnamed regex captures are configured or when a background cache update…
CVE-2026-60065, published 2026-07-15. Medium severity, CVSS 5.3. EPSS: 0.4% chance of exploitation in the next 30 days. When NGINX Plus is configured to use the Message Queuing Telemetry Transport (MQTT) filter module (ngx_stream_mqtt_filter_module), unauthenticated attackers can send requests with conditions beyond…
CVE-2026-56434, published 2026-07-15. Medium severity, CVSS 6.5. EPSS: 0.4% chance of exploitation in the next 30 days. NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_ssi_module module. This vulnerability may exist when the Server-Side Includes (SSI), proxy_pass, and proxy_buffering…
CVE-2026-55723, published 2026-07-15. High severity, CVSS 8.3. EPSS: 0.5% chance of exploitation in the next 30 days. When NGINX Ingress Controller is configured with Custom Resource Definitions (CRDs) or Ingress annotations, an injection vulnerability exists in the configuration generator of NGINX Ingress…
CVE-2026-52865, published 2026-07-15. Medium severity, CVSS 6.5. EPSS: 0.5% chance of exploitation in the next 30 days. When NGINX Ingress Controller processes Ingress or TransportServer resources, an authenticated, remote attacker with permission to create or modify Ingress or TransportServer resources can cause the…
CVE-2026-48142, published 2026-06-17. Medium severity, CVSS 4.8. EPSS: 0.4% chance of exploitation in the next 30 days. NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_charset_module module. When content is served or proxied through a location block with both source_charset utf-8; and a…