Loading vulnerability…
Configuration Injection in ingress-nginx rewrite-target Annotation
CVE-2026-3288 is a high-severity configuration injection vulnerability in the Kubernetes ingress-nginx NGINX Ingress Controller. The flaw affects processing of Ingress resources that use the nginx.ingress.kubernetes.io/rewrite-target annotation. The controller interpolates the user-controlled Ingress path value from spec.rules.http.paths.path into generated nginx configuration in buildProxyPass() without proper sanitization or escaping. By including a double-quote character in the path, an attacker can terminate the intended quoted regex context and inject arbitrary nginx directives into the generated configuration. The issue is related to incomplete remediation of a prior path injection flaw, where sanitization was added to buildLocation() but omitted from buildProxyPass(). Available reporting also indicates that built-in validation was insufficient because its blocklist did not cover all dangerous directives and intended path validation logic was not actually enforced. Successful exploitation can result in arbitrary code execution in the context of the ingress-nginx controller and disclosure of Kubernetes Secrets accessible to that controller.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can allow arbitrary nginx configuration injection, which may be leveraged for code execution in the context of the ingress-nginx controller. Because the controller commonly has broad access to Kubernetes Secrets and, in default deployments, may access Secrets cluster-wide, the vulnerability can also expose sensitive credentials and other secret material. Additional reported outcomes include response hijacking, phishing-style redirects, credential reflection, internal information disclosure, and denial of service through invalid or malicious nginx configuration.
If you can’t patch tonight, do this now.
Until patching is completed, restrict Kubernetes RBAC permissions so only tightly controlled principals can create or modify Ingress resources. Review and reduce the ingress-nginx controller's access to Secrets to the minimum required scope rather than broad cluster-wide access. Monitor Kubernetes audit activity for suspicious Ingress create, update, or patch operations, especially path values containing unexpected special characters such as double quotes. Additional runtime and audit-log detections can help identify exploitation attempts that bypass incomplete controller-side validation.
Patch, then assume compromise.
Upgrade ingress-nginx to a fixed release. Affected versions are releases prior to v1.13.8, v1.14.4, and v1.15.0. Fixed versions are v1.13.8, v1.14.4, and v1.15.0, which add the missing sanitization to buildProxyPass() and address the configuration injection path.
1 exploit validated by Mallory's analysis. Hidden: 1 rejected by Mallory's analysis as not a working exploit.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
26 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.