Read the docs
TI-2021-05914 Aliases CVE-2021-23055GHSA-38cm-wqx5-m22m

Incorrect permission assignment in NGINX Ingress Controller

Priority LOW 30CWE-732Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · None · None
Fix status
No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA.

Summary

On version 2.x before 2.0.3 and 1.x before 1.12.3, the command line restriction that controls snippet use with NGINX Ingress Controller does not apply to Ingress objects. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Why it matters now

EPSS 0.00769 55th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
—NGINX Ingress Controller2.x before 2.0.3 and 1.x before 1.12.3—No fix listedCNA
  • NGINX Ingress Controller Vendor— Affected 2.x before 2.0.3 and 1.x before 1.12.3 Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:f5:nginx_ingress_controller:*:*:*:*:*:*:*:*1.0.0 to before 1.12.3; 2.0.0 to before 2.0.3VulnerableF5
  • cpe:2.3:a:f5:nginx_ingress_controller:*:*:*:*:*:*:*:* Versions 1.0.0 to before 1.12.3; 2.0.0 to before 2.0.3 Vulnerable ·F5

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-23055
  2. 2026-10-03 Alias added: GHSA-38cm-wqx5-m22m

References

Advisory 1

  • TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
  • TI-2026-31136 NGINX ngx_http_rewrite_module vulnerability CVSS 4.0CRITICAL 9.2
  • TI-2026-30813 NGINX Map directive and Regex matching vulnerability CVSS 4.0CRITICAL 9.2
  • TI-2026-08132 NGINX ngx_http_rewrite_module vulnerability CVSS 4.0CRITICAL 9.2
  • TI-2026-30812 NGINX Open-Source ngx_http_v3_module vulnerability CVSS 4.0CRITICAL 9.2
  • TI-2026-30432 NGINX ngx_http_proxy_v2_module and ngx_http_grpc_module vulnerability CVSS 4.0CRITICAL 9.2
See all 24 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences