Loading vulnerability…
NGINX Configuration Injection in Kubernetes ingress-nginx
CVE-2026-24512 is a configuration injection vulnerability in the Kubernetes ingress-nginx controller. Insufficient escaping of the Ingress rules.http.paths.path field in buildLocation() allows attacker-controlled path values containing a double quote to escape the intended configuration context and inject NGINX directives. An authenticated user permitted to create or modify Ingress resources can potentially execute arbitrary code in the controller context and disclose Kubernetes Secrets accessible to its service account. Default installations permit the controller to access Secrets cluster-wide. The vulnerability was fixed in ingress-nginx v1.13.7 and v1.14.3 by applying sanitizeQuotedRegex() to buildLocation().
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can compromise the ingress-nginx controller and expose any Kubernetes Secrets its service account can read, potentially including all Secrets across the cluster under default permissions. Arbitrary code execution can undermine controller confidentiality, integrity, and availability. Stolen credentials may enable further unauthorized access, while compromise of shared ingress infrastructure can affect applications across multiple namespaces.
If you can’t patch tonight, do this now.
Until upgrading, deploy a validating admission policy that rejects Ingress resources using the ImplementationSpecific pathType. Restrict permission to create or modify Ingress resources to trusted identities, and minimize the controller service account's access to Secrets, avoiding cluster-wide access where possible. Audit existing Ingress resources and monitor Kubernetes audit logs for suspicious path values, particularly double quotes, in successful create, update, or patch operations. These access restrictions and monitoring measures reduce exposure but do not replace patching.
Patch, then assume compromise.
Upgrade ingress-nginx to v1.13.7 or later in the 1.13 release line, or v1.14.3 or later in the 1.14 release line, and verify that the corrected controller image is running. Prefer a newer release that also addresses the related CVE-2026-3288: the original fix sanitized buildLocation() but left a separate injection path in buildProxyPass(). If controller compromise is suspected, investigate affected resources and rotate potentially exposed Secrets and credentials.
1 exploit validated by Mallory's analysis. Hidden: 1 not yet analyzed, such as Exploit-DB entries.
36 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.