High severity · published Mar 19, 2026
CVE-2026-4342
ingress-nginx comment-based nginx configuration injection
8.8
CVSS
1.4%
EPSS
No
On KEV
Description
A security issue was discovered in ingress-nginx where a combination of Ingress annotations can be used to inject configuration into nginx. This can lead to arbitrary code execution in the context of the ingress-nginx controller, and disclosure of Secrets accessible to the controller. (Note that in the default installation, the controller can access all Secrets cluster-wide.)
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.4% · higher than 73% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
IN
ingress-nginx · Kubernetes
before 1.13.9; before 1.14.5; before 1.15.1 · source: vendor
NI
Nginx Ingress Controller · Kubernetes
before 1.13.9; 1.14.0 before 1.14.5; 1.15.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-4342
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-4342
Issue Tracking
https://github.com/kubernetes/kubernetes/issues/137893
Mailing List
http://www.openwall.com/lists/oss-security/2026/03/19/9
More from ingress-nginx
8.8
CVE-2026-3288
ingress-nginx rewrite-target nginx configuration injection
8.8
CVE-2025-15566
ingress-nginx auth-proxy-set-headers nginx configuration injection
8.8
CVE-2026-24512
ingress-nginx auth-method nginx configuration injection
8.8
CVE-2026-1580
ingress-nginx auth-method nginx configuration injection
8.8
CVE-2023-5044
Code injection via nginx.ingress.kubernetes.io/permanent-redirect annotation