CVE-2026-4342

Published: Mar 19, 2026Modified: Jun 17, 2026

8.8

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploitability: 2.8 / Impact: 5.9

Source: NVD

Description

A security issue was discovered in ingress-nginx where a combination of Ingress annotations can be used to inject configuration into nginx. This can lead to arbitrary code execution in the context of the ingress-nginx controller, and disclosure of Secrets accessible to the controller. (Note that in the default installation, the controller can access all Secrets cluster-wide.)

Affected (3)

Products: Kubernetes: Nginx Ingress Controller

Kubernetes

1 product

Nginx Ingress Controller

Configuration A

3 vulnerable

Vulnerable Software	Affected Versions
Kubernetes Nginx Ingress Controller	Before 1.13.9
Kubernetes Nginx Ingress Controller	From 1.14.0 to 1.14.5
Kubernetes Nginx Ingress Controller	Version 1.15.0

Related CWEs

CWE-20

Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

References (2)

https://github.com/kubernetes/kubernetes/issues/137893

Source: jordan@liggitt.net

Issue Tracking

http://www.openwall.com/lists/oss-security/2026/03/19/9

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing ListThird Party Advisory

Timeline

No history available yet.