CVE-2026-4342: ingress-nginx comment-based nginx configuration injection
A security issue was discovered in ingress-nginx where a combination of Ingress annotations can be used to inject configuration into nginx. This can lead to arbitrary code execution in the context of the ingress-nginx controller, and disclosure of Secrets accessible to the controller. (Note that in the default installation, the controller can access all Secrets cluster-wide.)
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-4342?
CVE-2026-4342 is considered to have a critical severity level due to its potential for arbitrary code execution.
How do I fix CVE-2026-4342?
You can mitigate CVE-2026-4342 by upgrading to the remedial version of ingress-nginx, specifically version 0.0.0-20260319175635-5183b7d86137 or later.
What causes CVE-2026-4342?
CVE-2026-4342 is caused by a combination of Ingress annotations that lead to improper handling of nginx configuration in ingress-nginx.
What are the consequences of CVE-2026-4342?
Exploiting CVE-2026-4342 can lead to arbitrary code execution in the context of the ingress-nginx controller, resulting in severe security breaches.
Is CVE-2026-4342 exploitable in all ingress-nginx versions?
CVE-2026-4342 is exploitable in versions of ingress-nginx prior to the fixed version 0.0.0-20260319175635-5183b7d86137.