Loading vulnerability…
Configuration Injection RCE in ingress-nginx auth-method Annotation
CVE-2026-1580 is a configuration injection vulnerability in ingress-nginx. The issue arises from unsafe handling of the nginx.ingress.kubernetes.io/auth-method Ingress annotation, which can be abused to inject attacker-controlled configuration into the generated nginx configuration. By supplying crafted annotation content through an Ingress resource, an attacker with the ability to create or modify Ingress objects can cause nginx to process unintended directives. Successful exploitation can result in arbitrary code execution in the security context of the ingress-nginx controller and exposure of Kubernetes Secrets that the controller is permitted to access. In default deployments, this may include Secrets across the cluster.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation enables remote arbitrary code execution in the context of the ingress-nginx controller. Because the controller commonly has access to Kubernetes Secrets and may, in default installations, be able to access Secrets cluster-wide, the vulnerability can also lead to disclosure of sensitive credentials, tokens, certificates, and other secret material. The resulting compromise may enable further cluster abuse, lateral movement, and broader impact on confidentiality, integrity, and availability.
If you can’t patch tonight, do this now.
Until patching is completed, reject or block use of the nginx.ingress.kubernetes.io/auth-method annotation through a validating admission policy or equivalent admission control. Restrict who can create or modify Ingress resources and annotations through RBAC. Reduce the ingress-nginx controller's permissions, especially access to Kubernetes Secrets, and avoid cluster-wide Secret access where not strictly required. Monitor for unexpected or suspicious changes to Ingress annotations that may indicate exploitation attempts.
Patch, then assume compromise.
Upgrade ingress-nginx to a fixed release. Reported fixed versions include v1.13.7 and v1.14.3; later versions are also intended to contain the fix. Apply the vendor-recommended ingress-nginx upgrade procedure and ensure all affected controller instances are updated.
No public exploits tracked yet. Mallory keeps watching.
18 sources tracked across advisories and community write-ups. News coverage will land here when it surfaces.
No news coverage yet. Advisories and community discussion only.