EUVD-2026-13343
GHSA-f53h-mxv9-cp98
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
5DescriptionCVE.org
A security issue was discovered in ingress-nginx where a combination of Ingress annotations can be used to inject configuration into nginx. This can lead to arbitrary code execution in the context of the ingress-nginx controller, and disclosure of Secrets accessible to the controller. (Note that in the default installation, the controller can access all Secrets cluster-wide.)
AnalysisAI
A configuration injection vulnerability in Kubernetes ingress-nginx controller allows authenticated attackers to inject arbitrary nginx configuration through specially crafted Ingress annotations, leading to remote code execution with controller privileges and exposure of all cluster Secrets. The vulnerability has a high CVSS score of 8.8 and affects the ingress-nginx controller's annotation parsing mechanism. No active exploitation (not in KEV) or public POC has been reported, though the attack requires only low privileges and network access.
Technical ContextAI
The vulnerability affects the Kubernetes ingress-nginx controller (CPE: cpe:2.3:a:kubernetes:ingress-nginx:*:*:*:*:*:*:*:*), which manages nginx-based ingress resources in Kubernetes clusters. The root cause is improper input validation (CWE-20) when processing Ingress annotations that are translated into nginx configuration directives. Ingress annotations are key-value pairs used to customize nginx behavior, but insufficient sanitization allows malicious annotations to break out of their intended context and inject arbitrary nginx configuration, including directives that execute system commands. The ingress-nginx controller typically runs with privileged access to read all Secrets across the entire Kubernetes cluster for SSL certificate management.
RemediationAI
Immediate patching to the latest ingress-nginx controller version that addresses CVE-2026-4342 is critical once a fix becomes available - monitor the Kubernetes security advisory at https://github.com/kubernetes/kubernetes/issues/137893 for patch releases. Until patching is possible, implement strict RBAC policies to limit who can create or modify Ingress resources, enable admission webhooks to validate Ingress annotations against an allowlist, and consider using Policy engines like OPA Gatekeeper to enforce annotation restrictions. Additionally, follow the principle of least privilege by limiting the ingress-nginx controller's access to only necessary Secrets rather than cluster-wide access where possible.
More in Kubernetes
View allA critical vulnerability in Kubernetes ingress-nginx controller allows unauthenticated attackers with pod network access
Credential-harvesting malware compromised 84 versions of 42 TanStack npm packages on 2026-05-11 via chained GitHub Actio
Kubernetes ingress-nginx contains a configuration injection vulnerability via the mirror-target and mirror-host Ingress
A security issue was discovered in ingress-nginx https://github.com/kubernetes/ingress-nginx where the `auth-url` Ingres
A security issue was discovered in ingress-nginx https://github.com/kubernetes/ingress-nginx where the `auth-tls-match-c
Kubernetes API server in all versions allow an attacker who is able to create a ClusterIP service and set the spec.exter
A security issue was discovered in Kubernetes where a user that can create pods on Windows nodes may be able to escalate
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Rated critical severity (CVSS 9.9), this vulne
Unauthenticated remote attackers can trigger complete database overwrites, server-side file reads, and SSRF attacks agai
The Kubernetes integration in GitLab Enterprise Edition 11.x before 11.2.8, 11.3.x before 11.3.9, and 11.4.x before 11.4
Fluentd configuration injection in the kube-logging Logging operator before 6.6.0 allows a namespace-scoped user who can
Kyverno Kubernetes policy engine prior to 1.x has a privilege escalation vulnerability (CVSS 9.9) allowing policy bypass
Same weakness CWE-20 – Improper Input Validation
View allVendor StatusVendor
SUSE
Severity: High| Product | Status |
|---|---|
| openSUSE Leap 15.6 | Fixed |
| SUSE Linux Enterprise Module for Package Hub 15 SP5 | Fixed |
| SUSE Linux Enterprise Module for Package Hub 15 SP6 | Fixed |
| openSUSE Leap 15.5 | Fixed |
Share
External POC / Exploit Code
Leaving vuln.today