8.3
High
CVE-2025-14727 NGINX Ingress Controller vulnerability
Description
A vulnerability exists in NGINX Ingress Controller's nginx.org/rewrite-target annotation validation. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVSS 3.1 detail
Vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:LExploitable remotely over the network, with an ordinary account and without any user action; an attacker can seriously compromise confidentiality, integrity or availability.
- Attack vector
- Network
- Attack complexity
- Low
- Privileges required
- Low
- Interaction
- None
- Scope
- Unchanged
- Confidentiality
- High
- Integrity
- High
- Availability
- Low
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| NGINX Ingress Controller 5.3 | 5.3.0 → < 5.3.1 | 5.3.1 |
| NGINX Ingress Controller 5.2 | earliest → < 5.2.0 | 5.2.0 |
| NGINX Ingress Controller 5.1 | earliest → < 5.1.0 | 5.1.0 |
| NGINX Ingress Controller 5.0 | earliest → < 5.0.0 | 5.0.0 |
| NGINX Ingress Controller 4.0 | earliest → < 4.0.0 | 4.0.0 |
| NGINX Ingress Controller 3.0 | earliest → < 3.0.0 | 3.0.0 |
Other CVEs of NGINX Ingress Controller
The 8 CVEs of NGINX Ingress Controller →
CVE-2026-104939
Description
NGINX Ingress Controller has a vulnerability when implementing an externalAuth policy for ingress
7.5
High
CVE-2026-94197
An authentication and authorization bypass vulnerability exists in F5 NGINX Kubernetes Ingress Controller (NIC) when…
7.5
High
CVE-2026-77180
When NGINX Ingress Controller is configured with Ingress annotations, an injection vulnerability exists in the…
8.3
High
CVE-2026-52865
When NGINX Ingress Controller processes Ingress or TransportServer resources, an authenticated, remote attacker with…
6.5
Medium