Predictive Vulnerability Intelligence.

Product

  • Product
  • Pricing
  • Documentation

Company

  • About
  • Partnerships
  • Blog
  • Support

Legal

  • Terms
  • Privacy
  • Data Licensing

© 2026 FAUCET Technologies LLC. All rights reserved.

CVE-2023-5044

60
FAUCET Score

CVE-2023-5044 describes a critical code injection vulnerability affecting the NGINX Ingress Controller for Kubernetes, specifically through the nginx.ingress.kubernetes.io/permanent-redirect annotation. This flaw carries a high CVSS score of 8.8, indicating a severe risk due to its network-based attack vector, low attack complexity, and potential for high impact on confidentiality, integrity, and availability. While there is no evidence of active exploitation, public exploit code, or KEV listing, the vulnerability has garnered community attention, as evidenced by a Reddit discussion.

Impacted Technologies

VendorProductVersion(s)CPE
>= 0, < 1.9.0CPE match
cpe:2.3:a:kubernetes:ingress-nginx:*:*:*:*:*:*:*:*
< 1.9.0CPE matchmatch criteria
cpe:2.3:a:kubernetes:ingress-nginx:*:*:*:*:*:*:*:*

CVSS Data

CVSS version used by this source: 3.1

8.8HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
Exploitability Score
2.8
Impact Score
5.9
CvssVersion
3.1

Exploit Intelligence

EPSS Score
56.57%
Probability of exploitation in next 30 days
EPSS Percentile
99.0%
Percentile rank of EPSS score among Peer Group
As of 2026-07-28
Model: v2026.06.15
This CVE's current EPSS score of 0.5657 is in the 98th percentile among its peer group of 17,844 CVEs.

Social Chatter

The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.3 Bluesky, 0.1 Mastodon, and 0.2 GitHub mentions.

Media Mentions

No media coverage found for this CVE.

The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Patch Available

Vendor Patches (6)

check_pointpatch availablevia llm_extracted
View patch
chromepatch availablevia llm_extracted
View patch
gopatch availablevia ghsa
Product: k8s.io/ingress-nginxFixed in: 1.9.0
infiniflowpatch availablevia llm_extracted
View patch
vuepatch availablevia llm_extracted
View patch
github_advisoryworkaround availablevia nvd_reference
View patch

Vendor Advisories (5)

goGHSA-fp9f-44c2-cw27high

Ingress-nginx code injection via nginx.ingress.kubernetes.io/permanent-redirect annotation

Oct 25, 2023
vuellm-vue-341946ccea9877e4

Code injection via nginx.ingress.kubernetes.io/permanent-redirect annotation

chromellm-chrome-e2a948eed3272d52

Code injection via nginx.ingress.kubernetes.io/permanent-redirect annotation

check_pointllm-check_point-c67cb94e5becded0

Code injection via nginx.ingress.kubernetes.io/permanent-redirect annotation

infiniflowllm-infiniflow-77cc6d87c7daf0f9

Code injection via nginx.ingress.kubernetes.io/permanent-redirect annotation

References

github.com / kubernetes/ingress-nginx/issues/10572
Issue TrackingMitigationVendor Advisory
groups.google.com / g/kubernetes-security-announce/c/ukuYYvRNel0
Mailing ListMitigation
security.netapp.com / advisory/ntap-20240307-0012
openwall.com / lists/oss-security/2023/10/25/3
Mailing ListThird Party Advisory