Ingress-Nginx Vulnerability Allow Attackers to Execute Arbitrary Code
A critical security vulnerability has been identified in ingress-nginx , a widely used Kubernetes ingress controller. This flaw permits authenticated attackers to execute arbitrary code and access sensitive cluster secrets.
A critical security vulnerability has been identified in ingress-nginx , a widely used Kubernetes ingress controller. This flaw permits authenticated attackers to execute arbitrary code and access sensitive cluster secrets.
The vulnerability, designated as CVE-2026-24512, impacts several versions of the software, necessitating immediate attention from administrators.
The issue resides in the rules.http.paths.path field of the Ingress resource. Attackers can exploit this to inject malicious configurations into the nginx web server .
This vulnerability enables threat actors to execute arbitrary code within the ingress-nginx controller's context.
Furthermore, attackers may obtain unauthorized access to Secrets that the controller is authorized to read.
In default setups, the ingress-nginx controller generally has access to all Secrets across the entire Kubernetes cluster, amplifying the potential impact significantly.
This vulnerability can be exploited remotely over a network with low attack complexity, requiring only low-level privileges without user interaction.
A critical security vulnerability has been identified in ingress-nginx , a widely used Kubernetes ingress controller.
The vulnerability affects the following ingress-nginx versions:
All versions < v1.13.7 All versions < v1.14.3
Organizations using ingress-nginx should act immediately to secure their Kubernetes clusters.
The Kubernetes security response committee advises upgrading to ingress-nginx version 1.13.7, 1.14.3, or any later release as soon as possible.
Comprehensive upgrade instructions are available in the official Ingress-NGINX upgrade documentation.
For scenarios where immediate upgrades are not possible, administrators can apply a temporary mitigation by deploying a validating admission controller.
This controller should be configured to reject any Ingress resources utilizing the ImplementationSpecific path type, effectively blocking the attack vector until an upgrade can be achieved.
Security teams should monitor their Kubernetes environments for indications of exploitation. Suspicious or malformed data within the rules.http.paths.path field of Ingress resources could signal an active exploitation attempt.
According to the Kubernetes advisory , organizations can verify if they are running vulnerable versions by executing the command: kubectl get pods --all-namespaces --selector app.kubernetes.io/name=ingress-nginx .
If evidence of exploitation is discovered, administrators should promptly contact the Kubernetes security team at security@kubernetes.io .
It is noteworthy that the maintenance of ingress-nginx will soon cease, as announced by the Kubernetes project, making migration to alternative ingress solutions a strategic consideration for long-term security.
Based on reporting by Cyber Security News.