Ingress-Nginx Vulnerability Allow Attackers to Execute Arbitrary Code

A critical security vulnerability has been discovered in ingress-nginx, a popular Kubernetes ingress controller, that could allow authenticated attackers to execute arbitrary code and access sensitive cluster secrets.

The vulnerability, tracked as CVE-2026-24512, affects multiple versions of the software and requires immediate action from administrators.

The security flaw exists in the rules.http.paths.path field of the Ingress resource, which attackers can exploit to inject malicious configuration into the nginx web server.

This configuration injection vulnerability enables threat actors to execute arbitrary code within the context of the ingress-nginx controller.

Additionally, attackers can gain unauthorized access to Secrets that the controller has permission to read.

In default installations, the ingress-nginx controller typically has access to all Secrets across the entire Kubernetes cluster, significantly amplifying the potential impact.

This indicates the flaw can be exploited remotely over a network with low attack complexity, requiring only low-level privileges and no user interaction.

Affected Versions

The vulnerability impacts the following ingress-nginx versions:

Organizations using ingress-nginx must take immediate action to protect their Kubernetes clusters.

The Kubernetes security response committee recommends upgrading to ingress-nginx version 1.13.7, 1.14.3, or any later release as soon as possible.

Detailed upgrade instructions are available in the official Ingress-NGINX upgrade documentation.

For environments where immediate upgrades are not feasible, administrators can implement a temporary mitigation by deploying a validating admission controller.

This controller should be configured to reject any Ingress resources that use the ImplementationSpecific path type, effectively blocking the attack vector until a proper upgrade can be completed.

Security teams should monitor their Kubernetes environments for signs of exploitation. Suspicious or malformed data within the rules.http.paths.The path field of Ingress resources could indicate an active exploitation attempt.

According to the Kubernetes advisory, Organizations can verify if they are running vulnerable versions by executing the command: kubectl get pods –all-namespaces –selector app.kubernetes.io/name=ingress-nginx.

If evidence of exploitation is discovered, administrators should immediately contact the Kubernetes security team at [email protected].

It’s worth noting that maintenance of ingress-nginx will soon cease, as announced by the Kubernetes project, making migration to alternative ingress solutions a strategic consideration for long-term security.