Critical ingress-nginx flaws enable NGINX config injection, RCE, and admission-controller DoS

Kubernetes maintainers disclosed multiple vulnerabilities in ingress-nginx affecting versions < 1.13.7 and < 1.14.3, including NGINX configuration injection paths that can lead to arbitrary code execution in the ingress-nginx controller context and Secrets disclosure. CVE-2026-24512 allows injection via the Ingress rules.http.paths.path field, and CVE-2026-1580 allows injection via the nginx.ingress.kubernetes.io/auth-method annotation; both are rated CVSS 8.8 and are especially high impact in default deployments where the controller can read Secrets cluster-wide. Recommended mitigations include upgrading to v1.13.7, v1.14.3, or later, and (as a temporary control) using validating admission policies to reject risky constructs such as ImplementationSpecific path types or the auth-method annotation.

A separate ingress-nginx issue, CVE-2026-24514 (CVSS 6.5), affects the validating admission controller feature and enables denial of service by sending oversized requests that drive memory consumption, potentially killing the controller pod or exhausting node memory. Detection guidance includes monitoring for unusually large requests (multi-megabyte) to the admission controller and suspicious payloads in rules.http.paths.path or the nginx.ingress.kubernetes.io/auth-method annotation. One referenced item describing CVE-2025-67601 in the Rancher CLI (credential/TLS handling weakness involving --skip-verify) is a different product and vulnerability and is not part of the ingress-nginx disclosures.