cloud-service-vulnerabilitywidely-deployed-product-advisoryidentity-authentication-vulnerability

Arbitrary Code Execution Flaw in Kubernetes ingress-nginx Requires Immediate Patching

Vulnerability Disclosure · 3 sources · Updated 4mo ago · First seen Mar 20, 2026

Belgium's Centre for Cybersecurity warned organizations to patch Kubernetes ingress-nginx immediately after disclosure of an arbitrary code execution issue affecting the widely used NGINX Ingress Controller. The flaw, tracked as CVE-2026-3288, is a high-severity configuration injection vulnerability that lets an authenticated user with permission to create or modify Ingress resources inject arbitrary nginx directives through a crafted double quote in the Ingress path field, potentially leading to remote code execution and exposure of secrets accessible to the controller.

Sysdig reported that CVE-2026-3288 was fixed on March 9, 2026 and stemmed from an incomplete remediation of the related CVE-2026-24512. According to the company, sanitization had been added to one code path but omitted from another, while built-in validation relied on an incomplete blocklist that attackers could bypass with payloads such as return directives. Affected releases include ingress-nginx versions before v1.13.8, v1.14.4, and v1.15.0; defenders were urged to upgrade, tighten RBAC permissions for Ingress changes, and monitor Kubernetes audit logs for signs of exploitation.

Do you run this?See affected versions and whether adversaries are exploiting it.

Check your exposure

Event timeline

How this story unfolded

Events from the most recent confirmed update back to the earliest known activity.

5 events · Mar 25, 2025 – Mar 20, 2026

Mar 20, 20268mo ago
Belgium CCB issues public warning to patch ingress-nginx immediately
On 2026-03-20, Belgium's Centre for Cybersecurity issued an advisory warning about arbitrary code execution in Kubernetes ingress-nginx and urged organizations to patch immediately. The advisory elevated public awareness of the risk following disclosure of the vulnerability.
Mar 17, 20268mo ago
Sysdig publishes technical analysis and detection guidance
On 2026-03-17, Sysdig published research explaining that CVE-2026-3288 stemmed from incomplete remediation of CVE-2026-24512 and described how DeepInspect validation could be bypassed. The post also provided detection guidance, including monitoring recommendations and a Falco rule based on Kubernetes audit logs.
Mar 9, 20268mo ago
Ingress-nginx patches CVE-2026-3288 configuration injection flaw
On 2026-03-09, ingress-nginx fixed CVE-2026-3288, a high-severity configuration injection vulnerability that could let an authenticated user who can create or modify Ingress resources inject arbitrary nginx directives. The issue affected releases before v1.13.8, v1.14.4, and v1.15.0 and could lead to remote code execution and disclosure of controller-accessible secrets.
Mar 25, 20252y ago
Traficom warns of multiple ingress-nginx RCE flaws and urges upgrades
On 2025-03-25, Finland's Traficom warned that multiple vulnerabilities in the Kubernetes ingress-nginx controller could allow an unauthenticated attacker to execute arbitrary code on vulnerable clusters. The advisory said versions 1.11.4 and earlier and 1.12.0 were affected, urged upgrading to 1.12.1 or 1.11.5, and pointed to Kubernetes mitigation guidance for cases where immediate patching was not possible.
Kuberneteksen ingress-nginx controller -komponentissa useita haavoittuvuuksia | Traficom
Date unknown
Ingress-nginx flaw CVE-2026-24512 is remediated incompletely
A prior vulnerability, CVE-2026-24512, was addressed in ingress-nginx, but the fix only added sanitization to buildLocation() and omitted buildProxyPass(). This incomplete remediation left a path for configuration injection to persist.

Linked entities

Related entities

Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.

Open in app →

Vulnerabilities

1 linked

Configuration Injection in ingress-nginx rewrite-target Annotation (CVE-2026-3288)

Affected products

1 linked

Nginx Ingress Controller

Do you run this?See whether adversaries are exploiting this yet, and where the affected versions run in your environment.

Check Your Exposure

Source coverage

Sources

3 references tracked. Mallory keeps watching after this page renders.

Belgium Ccb Security AdvisoriesNews · Mar 20, 2026

Warning: Arbitrary Code Execution in Kubernetes ingress-nginx, Patch Immediately! | CCB SafeonwebOpen source ↗

Sysdig BlogNews · Mar 17, 2026

Detecting CVE-2026-3288 & CVE-2026-24512: Ingress-nginx configuration injection vulnerabilities for Kubernetes | SysdigOpen source ↗

Kyberturvallisuuskeskus AlertsNews · Mar 25, 2025

Kuberneteksen ingress-nginx controller -komponentissa useita haavoittuvuuksia | TraficomOpen source ↗

Mallory platform

See the full picture, correlated to your attack surface.

This page covers what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which threat actors are using it right now, and what to deploy next.

Start Free Trial Open in App

Exposure mappingMap indicators from this story to your assets and identify affected systems in minutes.

Threat actor evidenceEvery observed campaign, victim, and pivot linked to actors named in this story.

Associated malwareMalware, exploits, and IOCs connected to the activity described here.

Detection signaturesYARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.

Scheduled alertsGet matching new stories delivered to your team as they break, not the next morning.

AI threadsAsk questions about this story and take action on the answers.

← Back to News

cloud-service-vulnerabilitywidely-deployed-product-advisoryidentity-authentication-vulnerability

Arbitrary Code Execution Flaw in Kubernetes ingress-nginx Requires Immediate Patching

Vulnerability Disclosure · 3 sources · Updated 4mo ago · First seen Mar 20, 2026

Do you run this?See affected versions and whether adversaries are exploiting it.

Check your exposure

Event timeline

How this story unfolded

Events from the most recent confirmed update back to the earliest known activity.

5 events · Mar 25, 2025 – Mar 20, 2026

Mar 20, 20268mo ago
Belgium CCB issues public warning to patch ingress-nginx immediately
On 2026-03-20, Belgium's Centre for Cybersecurity issued an advisory warning about arbitrary code execution in Kubernetes ingress-nginx and urged organizations to patch immediately. The advisory elevated public awareness of the risk following disclosure of the vulnerability.
Mar 17, 20268mo ago
Sysdig publishes technical analysis and detection guidance
On 2026-03-17, Sysdig published research explaining that CVE-2026-3288 stemmed from incomplete remediation of CVE-2026-24512 and described how DeepInspect validation could be bypassed. The post also provided detection guidance, including monitoring recommendations and a Falco rule based on Kubernetes audit logs.
Mar 9, 20268mo ago
Ingress-nginx patches CVE-2026-3288 configuration injection flaw
On 2026-03-09, ingress-nginx fixed CVE-2026-3288, a high-severity configuration injection vulnerability that could let an authenticated user who can create or modify Ingress resources inject arbitrary nginx directives. The issue affected releases before v1.13.8, v1.14.4, and v1.15.0 and could lead to remote code execution and disclosure of controller-accessible secrets.
Mar 25, 20252y ago
Traficom warns of multiple ingress-nginx RCE flaws and urges upgrades
On 2025-03-25, Finland's Traficom warned that multiple vulnerabilities in the Kubernetes ingress-nginx controller could allow an unauthenticated attacker to execute arbitrary code on vulnerable clusters. The advisory said versions 1.11.4 and earlier and 1.12.0 were affected, urged upgrading to 1.12.1 or 1.11.5, and pointed to Kubernetes mitigation guidance for cases where immediate patching was not possible.
Kuberneteksen ingress-nginx controller -komponentissa useita haavoittuvuuksia | Traficom
Date unknown
Ingress-nginx flaw CVE-2026-24512 is remediated incompletely
A prior vulnerability, CVE-2026-24512, was addressed in ingress-nginx, but the fix only added sanitization to buildLocation() and omitted buildProxyPass(). This incomplete remediation left a path for configuration injection to persist.

Linked entities

Related entities

Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.

Open in app →

Vulnerabilities

1 linked

Configuration Injection in ingress-nginx rewrite-target Annotation (CVE-2026-3288)

Affected products

1 linked

Nginx Ingress Controller

Do you run this?See whether adversaries are exploiting this yet, and where the affected versions run in your environment.

Check Your Exposure

Source coverage

Sources

3 references tracked. Mallory keeps watching after this page renders.

Belgium Ccb Security AdvisoriesNews · Mar 20, 2026

Warning: Arbitrary Code Execution in Kubernetes ingress-nginx, Patch Immediately! | CCB SafeonwebOpen source ↗

Sysdig BlogNews · Mar 17, 2026

Detecting CVE-2026-3288 & CVE-2026-24512: Ingress-nginx configuration injection vulnerabilities for Kubernetes | SysdigOpen source ↗

Kyberturvallisuuskeskus AlertsNews · Mar 25, 2025

Kuberneteksen ingress-nginx controller -komponentissa useita haavoittuvuuksia | TraficomOpen source ↗

Mallory platform

See the full picture, correlated to your attack surface.

This page covers what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which threat actors are using it right now, and what to deploy next.

Start Free Trial Open in App

Exposure mappingMap indicators from this story to your assets and identify affected systems in minutes.

Threat actor evidenceEvery observed campaign, victim, and pivot linked to actors named in this story.

Associated malwareMalware, exploits, and IOCs connected to the activity described here.

Detection signaturesYARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.

Scheduled alertsGet matching new stories delivered to your team as they break, not the next morning.

AI threadsAsk questions about this story and take action on the answers.

Arbitrary Code Execution Flaw in Kubernetes ingress-nginx Requires Immediate Patching

How this story unfolded

Belgium CCB issues public warning to patch ingress-nginx immediately

Sysdig publishes technical analysis and detection guidance

Ingress-nginx patches CVE-2026-3288 configuration injection flaw

Traficom warns of multiple ingress-nginx RCE flaws and urges upgrades

Ingress-nginx flaw CVE-2026-24512 is remediated incompletely

Related entities

Vulnerabilities

Affected products

Sources

See the full picture, correlated to your attack surface.

Related stories

Critical ingress-nginx flaws enable Kubernetes cluster takeover

Critical ingress-nginx flaws enable NGINX config injection, RCE, and admission-controller DoS

Critical RCE Flaw in NGINX and F5 NGINX Products Prompts Urgent Patching

Arbitrary Code Execution Flaw in Kubernetes ingress-nginx Requires Immediate Patching

How this story unfolded

Belgium CCB issues public warning to patch ingress-nginx immediately

Sysdig publishes technical analysis and detection guidance

Ingress-nginx patches CVE-2026-3288 configuration injection flaw

Traficom warns of multiple ingress-nginx RCE flaws and urges upgrades

Ingress-nginx flaw CVE-2026-24512 is remediated incompletely

Related entities

Vulnerabilities

Affected products

Sources

See the full picture, correlated to your attack surface.

Related stories

Critical ingress-nginx flaws enable Kubernetes cluster takeover

Critical ingress-nginx flaws enable NGINX config injection, RCE, and admission-controller DoS

Critical RCE Flaw in NGINX and F5 NGINX Products Prompts Urgent Patching