CVE-2026-3288
HighSummary
A security issue was discovered in ingress-nginx where the `nginx.ingress.kubernetes.io/rewrite-target` Ingress annotation can be used to inject configuration into nginx. This can lead to arbitrary code execution in the context of the ingress-nginx controller, and disclosure of Secrets accessible to the controller.
Risk Assessment
The organization may be exposed to arbitrary code execution and disclosure of sensitive data, potentially leading to serious security breaches.
Recommendation
It is recommended to review and restrict the use of the `nginx.ingress.kubernetes.io/rewrite-target` annotation, as well as monitor access to Secrets in the cluster.
Other vulnerabilities in ingress-nginx
See all- CVE-2026-4342High
A security issue was discovered in ingress-nginx where a combination of Ingress annotations can be used to inject configuration into nginx. This can lead to arbitrary code execution in the context of the ingress-nginx controller, and disclosure of Secrets accessible to the controller.
- CVE-2026-116472Low
In ingress-nginx, a user with permission to create an Ingress may use the mirror-target annotation to target an unauthenticated configuration API within the ingress-nginx controller, allowing write commands to be submitted. Corrupting data in that API causes all traffic through ingress-nginx to be dropped until an Ingress configuration change or controller restart recreates the data correctly; in principle, this write access could also redirect traffic from other Ingresses.
Original NVD description (English source)
A security issue was discovered in ingress-nginx where the `nginx.ingress.kubernetes.io/rewrite-target` Ingress annotation can be used to inject configuration into nginx. This can lead to arbitrary code execution in the context of the ingress-nginx controller, and disclosure of Secrets accessible to the controller. (Note that in the default installation, the controller can access all Secrets cluster-wide.)
Vulnerability data from NVD (NIST) · CISA KEV · EPSS