Remote code execution vulnerability affecting Ingress-Nginx
A vulnerability affecting Ingress-Nginx would allow an authenticated attacker to execute arbitrary code and access sensitive information on affected systems.
Description
Technical context and vulnerability details
Ingress-Nginx is an ingress controller for Kubernetes using Nginx as a reverse proxy and load balancer. This solution is affected by a vulnerability labeled CVE-2026-4342 resulting from insufficient validation of Ingress annotations, allowing the injection of malicious configurations into Nginx. Exploitation of this vulnerability would allow an authenticated attacker to manipulate controller configuration to execute arbitrary code and compromise secrets stored within the cluster. It is classified high with a severity score of 8.8 according to CVSS V3.1.
Potential Risks & Impact
Potential consequences upon exploitation
- Remote Arbitrary Code Execution;
- Compromise of system integrity;
- Data privacy breach;
Affected systems
Products, components and targeted versions
- Versions of Ingress-Nginx prior to versions 1.13.9, 1.14.5, 1.15.1;
Recommended Remediations & Actions
Immediate actions and recommended mitigations
- Update Ingress-Nginx to its latest stable version while planning the transition to the Kubernetes API Gateway, the latter now being the recommended solution given the cessation of official maintenance of Ingress-Nginx;
Sources & External Links
Vendor security advisories and documentation
Advisory Specifications
CSIRT Emergency Response
Is your organization affected or do you suspect an incident? Our security experts are available to assist.
Report an incidentGet our alerts by email
Subscribe to receive our security alert bulletins and Iservices news straight to your inbox.