Loading vulnerability…
CVE-2026-24512 is a configuration injection vulnerability in ingress-nginx, the Kubernetes NGINX Ingress Controller. The flaw is in handling of the Ingress rules.http.paths.path field, which can be incorporated into generated NGINX configuration in a way that allows attacker-controlled input to inject unintended directives. The issue affects ingress-nginx deployments prior to the fixed releases in the 1.13.x and 1.14.x branches. Successful exploitation can cause arbitrary code execution in the security context of the ingress-nginx controller. Because the controller commonly has permission to read Kubernetes Secrets, exploitation can also expose sensitive secret material available to that controller, including cluster-wide Secrets in default installations.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
ImplementationSpecific path type. Also reduce exposure by tightening RBAC so only trusted principals can create or modify Ingress resources, limiting the ingress-nginx controller’s access to Secrets wherever feasible, and monitoring for suspicious or malformed values in the Ingress path field that may indicate attempted configuration injection.Patch, then assume compromise.
1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos (1 hidden).
This repository is a self-contained Docker lab and exploit kit for a simulated CVE-2026-3288 NGINX Ingress Controller configuration-injection issue. It is not tied to a common exploit framework. The repo contains 15 files: documentation (README.md, INSTALL.md, TESTING.md), Docker orchestration (docker-compose.yml), a vulnerable NGINX container and Flask backend, an automated Python exploit, a shell-based manual test harness, payload examples, a log-monitoring script, and a cleanup script. Core exploit logic is in exploits/exploit.py. The Python script uses requests.Session to target a base URL, first checking /health, then attempting six scenarios: response hijacking, Authorization header theft, phishing redirect injection, internal IP disclosure, cookie theft, and User-Agent reflection. Payloads are path strings containing an injected double quote followed by NGINX directives such as return 200 or return 302. Success criteria are simple response-content/status checks, making this an operational but basic exploit rather than a weaponized framework module. The vulnerable environment is implemented in docker/nginx/vulnerable-config.conf and docker/backend/app.py. NGINX listens on port 80 and is published to host port 9090. It proxies to an upstream named backend at backend:5000. The config intentionally simulates unsafe path handling around /api and /vuln, includes a /login location that reflects Authorization data via headers and proxying, an /admin path that can disclose an internal IP string, a /backend proxy path, and /health. The Flask backend exposes /, /health, /api/users, /api/data, /login, /admin, and /secret, with several endpoints returning sensitive-looking demo data and reflected headers. Fingerprintable infrastructure includes localhost-based lab URLs, backend:5000 as the upstream service, host ports 9090/9443, NGINX config/log file paths, and attacker redirect domains such as evil.com. The repository also includes detection/monitor-logs.sh, which tails docker-compose nginx logs and greps for suspicious injected directives like return, rewrite, set, add_header, and proxy_pass followed by quotes. Overall, the repository’s purpose is training and demonstration of web-based configuration injection leading to response manipulation and information disclosure, not stealthy post-exploitation or real RCE delivery.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
35 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A path injection vulnerability in ingress-nginx buildLocation() that was fixed earlier, but whose incomplete remediation led to the related CVE-2026-3288 issue.
A path injection vulnerability in ingress-nginx buildLocation() that was fixed earlier and is closely related to CVE-2026-3288 because both use the Ingress path field as the injection vector.
Unknown (listed as a trending CVE affecting ingress-nginx; no technical details provided in the content).
Unknown (listed as a trending CVE affecting ingress-nginx; no technical details provided in the content).
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.