CVE-2021-23055 Security feature bypass in NGINX Ingress Controller
Attackers can bypass command line restrictions to inject arbitrary NGINX configurations via Ingress objects, potentially leading to code execution.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2021-23055?
CVE-2021-23055 is a medium-severity vulnerability in NGINX Ingress Controller, published on 21 Apr 2022. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
On version 2.x before 2.0.3 and 1.x before 1.12.3, the command line restriction that controls snippet use with NGINX Ingress Controller does not apply to Ingress objects. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Weakness: CWE-732
Which versions are affected by CVE-2021-23055?
1 open source package ship an affected version, including nginx-ingress-controller. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
nginx-ingress-controller Bitnami | From 1.0.0 | 1.12.3, 2.0.3 |
Products include F5 Nginx Ingress Controller.
How do I fix CVE-2021-23055?
Upgrade nginx-ingress-controller to a fixed version for your release line: 1.12.3 or 2.0.3.
Is CVE-2021-23055 being exploited?
There is no known exploitation of CVE-2021-23055 in the wild and no public exploit code.
Other vulnerabilities in NGINX Ingress Controller
- CVE-2026-55723 NGINX Ingress Controller vulnerability
- CVE-2025-14727 NGINX Ingress Controller vulnerability
- CVE-2026-52865 NGINX Ingress Controller vulnerability
- CVE-2022-41743 NGINX ngx_http_hls_module vulnerability CVE-2022-41743
- CVE-2022-30535 NGINX Ingress Controller vulnerability CVE-2022-30535
Sources
Also known as BIT-nginx-ingress-controller-2021-23055, GHSA-38cm-wqx5-m22m.