CVE-2026-52865: F5 Nginx Ingress Controller DoS Vulnerability

CVE-2026-52865 Overview

CVE-2026-52865 is a denial-of-service vulnerability in F5 NGINX Ingress Controller. An authenticated remote attacker with write access to Ingress or TransportServer resources can send a malformed resource that terminates the controller process. The controller then enters a persistent crash loop while the malformed resource remains in the Kubernetes cluster.

The issue affects the control plane only. There is no data plane exposure, and existing traffic-serving NGINX worker processes are not directly compromised. The vulnerability is classified under [CWE-476] NULL Pointer Dereference.

Critical Impact
A single authenticated attacker with Ingress or TransportServer write permission can crash the NGINX Ingress Controller cluster-wide, disrupting all ingress configuration reconciliation until the malformed resource is removed.

Affected Products

F5 NGINX Ingress Controller (supported versions processing Ingress resources)
F5 NGINX Ingress Controller (supported versions processing TransportServer resources)
End of Technical Support (EoTS) versions are not evaluated by F5

Discovery Timeline

2026-07-15 - CVE-2026-52865 published to NVD
2026-07-16 - Last updated in NVD database

Technical Details for CVE-2026-52865

Vulnerability Analysis

The NGINX Ingress Controller watches Kubernetes API objects and translates Ingress and TransportServer custom resources into NGINX configuration. During this reconciliation, the controller parses attacker-controlled fields from the submitted resource. A malformed resource triggers a NULL pointer dereference in the parsing or validation logic, causing the controller process to abort.

Because the offending resource is persisted in etcd, Kubernetes restarts the controller pod, which re-reads the same resource and crashes again. This produces a persistent CrashLoopBackOff state. All ingress configuration changes across the cluster stall until an administrator identifies and removes the malformed object.

The attack is a control plane denial of service. NGINX worker processes already handling traffic continue running with their last valid configuration, but new services, updated routes, and TLS renewals cannot be applied.

Root Cause

The root cause is a missing nil check in the Go code path that processes Ingress or TransportServer resource fields. When a specific field combination is absent or malformed, the controller dereferences a nil pointer instead of returning a validation error. This bypasses the admission-webhook path that would normally reject invalid input.

Attack Vector

Exploitation requires network access to the Kubernetes API server and Kubernetes RBAC permissions to create or updateIngress or TransportServer resources in any namespace watched by the controller. The attacker submits a crafted resource manifest through kubectl, the Kubernetes API, or any CI/CD pipeline with equivalent credentials. No user interaction is required. See the F5 Security Advisory K000161834 for vendor technical details.

Detection Methods for CVE-2026-52865

Indicators of Compromise

NGINX Ingress Controller pods entering repeated CrashLoopBackOff state with matching restart timestamps across replicas
Controller logs showing a panic or nil pointer dereference immediately after processing a specific Ingress or TransportServer object
Kubernetes audit log entries showing create or update operations on Ingress or TransportServer resources immediately preceding controller crashes

Detection Strategies

Correlate Kubernetes audit logs for ingresses.networking.k8s.io and transportservers.k8s.nginx.org write events with controller pod restart events
Alert on NGINX Ingress Controller pods with more than three restarts within a five-minute window
Monitor for Go runtime panic or SIGSEGV strings in controller container logs

Monitoring Recommendations

Enable Kubernetes API audit logging at the RequestResponse level for ingress-related resources and forward events to a centralized SIEM
Track the kube_pod_container_status_restarts_total metric for ingress controller pods via Prometheus
Review RBAC bindings that grant ingresses or transportservers write permissions and reduce privileged accounts to the minimum required

How to Mitigate CVE-2026-52865

Immediate Actions Required

Upgrade F5 NGINX Ingress Controller to the fixed version listed in F5 Security Advisory K000161834
Audit and restrict Kubernetes RBAC to limit create and update verbs on Ingress and TransportServer resources to trusted service accounts and users
If the controller is already in a crash loop, identify the offending resource via audit logs and delete it with kubectl delete before restarting the controller

Patch Information

F5 has published remediation guidance in Security Advisory K000161834. Apply the vendor-provided fixed release for your deployed NGINX Ingress Controller branch. Versions that have reached End of Technical Support are not evaluated and should be migrated to a supported release.

Workarounds

Deploy a validating admission webhook or Kubernetes policy engine such as Kyverno or Gatekeeper to reject Ingress and TransportServer resources with the malformed field patterns described in the F5 advisory
Restrict namespaces watched by the ingress controller using the -watch-namespace flag to reduce the attack surface
Require pull-request review and CI validation of ingress manifests before applying them to production clusters

bash

# Example: restrict Ingress/TransportServer write access via RBAC
kubectl create clusterrole ingress-writer-restricted \
  --verb=get,list,watch \
  --resource=ingresses.networking.k8s.io,transportservers.k8s.nginx.org

# Identify and remove a malformed resource causing controller crash loop
kubectl get ingress,transportserver -A -o wide
kubectl delete ingress <name> -n <namespace>