CVE-2026-4342
HighSummary
A security issue was discovered in ingress-nginx where a combination of Ingress annotations can be used to inject configuration into nginx. This can lead to arbitrary code execution in the context of the ingress-nginx controller, and disclosure of Secrets accessible to the controller.
Risk Assessment
The organization may be exposed to unauthorized code execution and disclosure of sensitive data, potentially leading to serious security breaches.
Recommendation
It is recommended to review and restrict the use of Ingress annotations and monitor access to the ingress-nginx controller to minimize risk.
Other vulnerabilities in ingress-nginx
Original NVD description (English source)
A security issue was discovered in ingress-nginx where a combination of Ingress annotations can be used to inject configuration into nginx. This can lead to arbitrary code execution in the context of the ingress-nginx controller, and disclosure of Secrets accessible to the controller. (Note that in the default installation, the controller can access all Secrets cluster-wide.)