What is the CVSS score of CVE-2026-3288?

CVE-2026-3288 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Kubernetes are affected by CVE-2026-3288?

A critical vulnerability in ingress-nginx allows attackers to inject malicious nginx configuration through a standard Kubernetes annotation, potentially enabling unauthorized access, data…

Is there a public PoC exploit available for CVE-2026-3288?

Yes, a public proof-of-concept exploit is available for CVE-2026-3288. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-3288?

Within 24 hours: Inventory all ingress-nginx deployments and identify which are internet-facing or process untrusted traffic; implement network segmentation to restrict access to ingress controller endpoints. Within 7 days: Deploy WAF rules to detect and block suspicious rewrite-target annotation patterns; implement admission controllers to validate and restrict ingress annotation values. Within 30 days: Evaluate alternative ingress controllers or hardened configurations; establish input validation policies for all Ingress resource definitions; conduct security audit of existing ingress configurations for indicators of compromise.

Kubernetes CVE-2026-3288

HIGH

Improper Input Validation (CWE-20)

2026-03-09 jordan@liggitt.net

Nginx Kubernetes RCE

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:56 vuln.today

CVE Published

Mar 09, 2026 - 21:16 nvd

HIGH 8.8

DescriptionCVE.org

A security issue was discovered in ingress-nginx where the nginx.ingress.kubernetes.io/rewrite-target Ingress annotation can be used to inject configuration into nginx. This can lead to arbitrary code execution in the context of the ingress-nginx controller, and disclosure of Secrets accessible to the controller. (Note that in the default installation, the controller can access all Secrets cluster-wide.)

Articles & Coverage 1

webflow.sysdig.com CVE-2026-3288: NGINX Ingress Controller Configuration Injection via Path Field Mar 17, 2026

AnalysisAI

Arbitrary code execution in ingress-nginx controllers via malicious rewrite-target annotations allows authenticated attackers to execute commands and exfiltrate cluster secrets. Kubernetes administrators using ingress-nginx are at risk, particularly in default configurations where the controller has cluster-wide secret access. No patch is currently available.

Technical ContextAI

Classified as CWE-20 (Improper Input Validation). A security issue was discovered in ingress-nginx where the nginx.ingress.kubernetes.io/rewrite-target Ingress annotation can be used to inject configuration into nginx. This can lead to arbitrary code execution in the context of the ingress-nginx controller, and disclosure of Secrets accessible to the controller. (Note that in the default installation, the controller can access all Secrets cluster-wide.)