CVE-2026-24513: ingress-nginx auth-url protection bypass
A security issue was discovered in ingress-nginx where the protection afforded by the auth-url Ingress annotation may not be effective in the presence of a specific misconfiguration.
If the ingress-nginx controller is configured with a default custom-errors configuration that includes HTTP errors 401 or 403, and if the configured default custom-errors backend is defective and fails to respect the X-Code HTTP header, then an Ingress with the auth-url annotation may be accessed even when authentication fails.
Note that the built-in custom-errors backend works correctly. To trigger this issue requires an administrator to specifically configure ingress-nginx with a broken external component.
Other sources
A security issue was discovered in ingress-nginx where the protection afforded by the auth-url Ingress annotation may not be effective in the presence of a specific misconfiguration.
If the ingress-nginx controller is configured with a default custom-errors configuration that includes HTTP errors 401 or 403, and if the configured default custom-errors backend is defective and fails to respect the X-Code HTTP header, then an Ingress with the auth-url annotation may be accessed even when authentication fails.
Note that the built-in custom-errors backend works correctly. Triggering this issue requires an administrator to specifically configure ingress-nginx with a broken external component.
— GitHub
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
go/k8s.io/ingress-nginxto a version that resolves this vulnerability.Fixed in 1.14.3 - Upgrade
Upgrade
go/k8s.io/ingress-nginxto a version that resolves this vulnerability.Fixed in 1.13.7 - Configuration
Configure ingress-nginx to use the built-in custom-errors backend, which correctly respects the X-Code HTTP header, instead of a defective external backend.
ingress-nginx default custom-errors backend = built-in custom-errors backend
Event History
Frequently Asked Questions
What is the severity of CVE-2026-24513?
CVE-2026-24513 has been rated as a medium severity vulnerability.
How do I fix CVE-2026-24513?
To remediate CVE-2026-24513, review your ingress-nginx configuration and ensure that the `auth-url` annotation is correctly implemented without misconfigurations.
What applications are affected by CVE-2026-24513?
CVE-2026-24513 affects the ingress-nginx controller within Kubernetes installations.
What can happen if CVE-2026-24513 is exploited?
Exploitation of CVE-2026-24513 may allow unauthorized access to resources that are meant to be protected by the `auth-url` annotation.
Is there a patch available for CVE-2026-24513?
As of now, there is no specific patch available for CVE-2026-24513, but users should regularly check for updates from the ingress-nginx project.