CVE-2021-23055 json
On version 2.x before 2.0.3 and 1.x before 1.12.3, the command line restriction that controls snippet use with NGINX Ingress Controller doe…
published 2022-04-21 4 y ago modified 2026-06-17 4 mo ago also BIT-nginx-ingress-controller-2021-23055 , EUVD-2021-10173
- cvss
- 6.5
- version 3.1, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.8%
- EPSS 0.8% chance of exploitation in 30 days, percentile 55%
- public exploits
- 0
- none known
Summary
On version 2.x before 2.0.3 and 1.x before 1.12.3, the command line restriction that controls snippet use with NGINX Ingress Controller does not apply to Ingress objects. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Patch / fix
- bitnami nginx-ingress-controller 1.12.3, 2.0.3
- f5 nginx_ingress_controller 1.12.3, 2.0.3
Exploit prediction
0.77% chance of exploitation in the next 30 days, higher than 55% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 3.1 | 6.5 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N |
| NVD | 2.0 | 4.0 | AV:N/AC:L/Au:S/C:P/I:N/A:N |
| OSV | 3.1 | 6.5 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| bitnami | nginx-ingress-controller | >=1.0.0, <1.12.3 >=2.0.0, <2.0.3 |
1.12.3 2.0.3 |
Affected products
- n/a NGINX Ingress Controller
Classification
- Weakness
-
- CWE-732 Incorrect Permission Assignment for Critical Resource
References
-
support.f5.com
/csp/article/K01051452
mitigation, vendor-advisory, web
Sources
- CVE List CVE-2021-23055
- NVD CVE-2021-23055
- OSV BIT-nginx-ingress-controller-2021-23055
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.