CVE-2026-24512: ingress-nginx auth-method nginx configuration injection
A security issue was discovered in ingress-nginx cthe rules.http.paths.path Ingress field can be used to inject configuration into nginx. This can lead to arbitrary code execution in the context of the ingress-nginx controller, and disclosure of Secrets accessible to the controller. (Note that in the default installation, the controller can access all Secrets cluster-wide.)
Other sources
A security issue was discovered in ingress-nginx where the rules.http.paths.path Ingress field can be used to inject configuration into nginx. This can lead to arbitrary code execution in the context of the ingress-nginx controller, and disclosure of Secrets accessible to the controller. (Note that in the default installation, the controller can access all Secrets cluster-wide.)
— MITRE
A security issue was discovered in ingress-nginx. Tthe rules.http.paths.path Ingress field can be used to inject configuration into nginx. This can lead to arbitrary code execution in the context of the ingress-nginx controller, and disclosure of Secrets accessible to the controller. (Note that in the default installation, the controller can access all Secrets cluster-wide.)
— GitHub
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
go/k8s.io/ingress-nginxto a version that resolves this vulnerability.Fixed in 1.14.3 - Upgrade
Upgrade
go/k8s.io/ingress-nginxto a version that resolves this vulnerability.Fixed in 1.13.7
Event History
Frequently Asked Questions
What is the severity of CVE-2026-24512?
CVE-2026-24512 is considered a critical vulnerability due to the potential for arbitrary code execution.
How do I fix CVE-2026-24512?
To fix CVE-2026-24512, you should upgrade to the latest version of ingress-nginx that addresses this vulnerability.
What impact does CVE-2026-24512 have on my system?
CVE-2026-24512 can lead to arbitrary code execution and potential disclosure of sensitive information in the context of the ingress-nginx controller.
What versions of ingress-nginx are affected by CVE-2026-24512?
CVE-2026-24512 impacts all versions of ingress-nginx that allow for configuration injection through the `rules.http.paths.path` Ingress field.
How does CVE-2026-24512 allow configuration injection?
CVE-2026-24512 enables configuration injection through improper sanitization of the `rules.http.paths.path` field, allowing attackers to manipulate nginx configurations.