CVE-2026-1580: falha de alta gravidade em Kubernetes ingress-nginx
ingress-nginx auth-method nginx configuration injection
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 8.8epss 0.5%
A security issue was discovered in ingress-nginx where the `nginx.ingress.kubernetes.io/auth-method` Ingress annotation can be used to inject configuration into nginx. This can lead to arbitrary code execution in the context of the ingress-nginx controller, and disclosure of Secrets accessible to the controller. (Note that in the default installation, the controller can access all Secrets cluster-wide.)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Produtos afetados
Kubernetes · ingress-nginxCVEs relacionadas — Kubernetes ingress-nginx
No mesmo produto, das mais perigosas para as menos.
CVE-2023-5044HIGHCode injection via nginx.ingress.kubernetes.io/permanent-redirect annotationEPSS 53.7%CVE-2024-7646HIGHCVE-2024-7646EPSS 27.0%CVE-2026-3288HIGHingress-nginx rewrite-target nginx configuration injectionEPSS 7.0%CVE-2023-5043HIGHIngress nginx annotation injection causes arbitrary command executionEPSS 2.5%CVE-2022-4886HIGHIngress-nginx `path` sanitization can be bypassed with `log_format` directiveEPSS 1.7%CVE-2026-4342HIGHingress-nginx comment-based nginx configuration injectionEPSS 1.5%