Read the docs
TI-2022-12692 Aliases CVE-2022-30535GHSA-cmrv-mf45-jw6v

NGINX Ingress Controller vulnerability CVE-2022-30535

Priority LOW 30CWE-20Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

In versions 2.x before 2.3.0 and all versions of 1.x, An attacker authorized to create or update ingress objects can obtain the secrets available to the NGINX Ingress Controller. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Why it matters now

EPSS 0.00714 53rd percentileScored 2026-11-07
Fix Fixed NGINX Ingress Controller (F5): 2.3.0

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
F5NGINX Ingress Controller2.x to before 2.3.0; 1.0.0 and later2.3.0Patch availableCNA
  • NGINX Ingress Controller VendorF5 Affected 2.x to before 2.3.0; 1.0.0 and later Fixed in 2.3.0 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:f5:nginx_ingress_controller:*:*:*:*:*:*:*:*1.0.0 to before 2.3.0VulnerableF5
  • cpe:2.3:a:f5:nginx_ingress_controller:*:*:*:*:*:*:*:* Versions 1.0.0 to before 2.3.0 Vulnerable ·F5

Remediation

  • Fix · CNA NGINX Ingress Controller (F5) Fixed in 2.3.0

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-30535
  2. 2026-10-03 Alias added: GHSA-cmrv-mf45-jw6v

References

Advisory 1

  • TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
  • TI-2026-31136 NGINX ngx_http_rewrite_module vulnerability CVSS 4.0CRITICAL 9.2
  • TI-2026-30813 NGINX Map directive and Regex matching vulnerability CVSS 4.0CRITICAL 9.2
  • TI-2026-08132 NGINX ngx_http_rewrite_module vulnerability CVSS 4.0CRITICAL 9.2
  • TI-2026-30812 NGINX Open-Source ngx_http_v3_module vulnerability CVSS 4.0CRITICAL 9.2
  • TI-2026-30432 NGINX ngx_http_proxy_v2_module and ngx_http_grpc_module vulnerability CVSS 4.0CRITICAL 9.2
See all 24 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences