Four new vulnerabilities in Ingress NGINX

Four vulnerabilities have been identified in the open source traffic controller, Ingress NGINX, which is widely used by organizations in Kubernetes deployments. These vulnerabilities can only be fixed by upgrading to the latest version. Of the four vulnerabilities, two are more severe, as they have a CVSS score of 8.8/10.

Ingress NGINX: The two most serious vulnerabilities

CVE -2026-1580 is an improper input validation. If the NGINX Ingress is configured with a default custom-errors that includes HTTP errors 401 or 403, and if the default custom-errors backendthat is configured is faulty and fails with the Code HTTP header, then an Ingress with the auth-url annotation may be accessible even when authentication fails.

See also: Attackers exploit old Windows vulnerability to disable EDR

CVE -2026-24512 is a configuration injection, where the rules.http.paths.path Ingress field can be used for configuration injection in nginx. This can lead to arbitrary code execution within the ingress-nginx controller and secret disclosure.

“This is a serious vulnerability,” said Kellman Meghu, CTO of Canadian-based DeepCove Cybersecurity, who has experience with Ingress NGINX. “If I could exploit it, I could make the Ingress gateway create a path directly to internal resources. It’s like opening up internals that should never have been exposed. Will this lead to further exposure or attacks? Probably, but in terms of impact, it’s a first step to gaining access to the environment, and from there it could go further. The least bad that could happen would be service disruption.”

NGINX is a reverse proxy/load balancer that generally acts as the receiver of web traffic and directs it to the application service for data transformation.

Importance of NGINX Ingress and Risks

Ingress NGINX is a version of NGINX that is used in Kubernetes as a front-end web traffic receiver and routes it to the application service for data transformation. It maps traffic to pod containers, which execute tasks without exposing the pods themselves. Meghu says that Ingress NGINX is the main network entry point and is effective because of its ability to dynamically reload its configuration, which allows it to adapt to changes within a Kubernetes cluster.

See also: Cisco Meeting Management: Vulnerability allows complete control of the system

These vulnerabilities only affect Ingress NGINX versions 1.13.7 and below, and 1.14.3 and below, if installed in a Kubernetes cluster.

The warning comes just weeks before support for Ingress NGINX ends. As of March, the project will no longer receive active maintenance, security patches, or bug fixes. Experts have urged Kubernetes administrators to switch to a new controller. They recommend the Kubernetes Gateway API as the standard for traffic management. Meghu notes that it is vendor-neutral and widely used. Other options include controllers like Cilium Ingress, Traefik, or HAProxy Ingress.

What other vulnerabilities were fixed?

In addition to the above, the CVE-2026-24513, which Meghu considers low risk, as an attacker needs to have a configuration that contains specific errors to exploit it.

Finally, there's CVE-2026-24514, which Meghu considers to be of medium risk. The controller could be subject to a denial of service attack if an attacker floods it with requests.

See also: Critical n8n vulnerability allows execution of system commands

These are just the latest issues with Ingress NGINX. A little over a year ago, Wiz discovered a group of vulnerabilities dubbed IngressNightmare. These vulnerabilities could allow unauthorized users to inject malicious NGINX configurations and execute malicious code on the Ingress NGINX pod, potentially exposing all the secrets of the cluster and leading to its takeover.

Satnam Narang, a senior research engineer at Tenable, told CSO that he considers the new vulnerabilities less worrisome than IngressNightmare.