CVE-2026-3288: ingress-nginx rewrite-target nginx configuration injection
A security issue was discovered in ingress-nginx where the nginx.ingress.kubernetes.io/rewrite-target Ingress annotation can be used to inject configuration into nginx. This can lead to arbitrary code execution in the context of the ingress-nginx controller, and disclosure of Secrets accessible to the controller. (Note that in the default installation, the controller can access all Secrets cluster-wide.)
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-3288?
CVE-2026-3288 is considered a critical vulnerability due to its potential for arbitrary code execution.
How do I fix CVE-2026-3288?
To fix CVE-2026-3288, update the ingress-nginx to version 1.13.8 or later, or ensure that you are outside the affected version ranges.
What causes CVE-2026-3288?
CVE-2026-3288 is caused by the misuse of the nginx.ingress.kubernetes.io/rewrite-target annotation which allows for configuration injection.
Which versions of ingress-nginx are affected by CVE-2026-3288?
Ingress-nginx versions lower than 1.13.8, as well as those between 1.14.0 and 1.14.4, are vulnerable to CVE-2026-3288.
What impact does CVE-2026-3288 have on system security?
CVE-2026-3288 can lead to unauthorized code execution, compromising the security of applications running within the Kubernetes environment.