IN
Product
ingress-nginx
15
CVEs
0
On KEV
8.8
Max CVSS
0
New 30D
Severity mix
Critical 0High 10Medium 4Low 1
Watch
Add ingress-nginx to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-4342 | 8.8 | Mar 19 | ingress-nginx comment-based nginx configuration injection Affected: before 1.13.9; before 1.14.5; before 1.15.1 |
| CVE-2026-3288 | 8.8 | Mar 9 | ingress-nginx rewrite-target nginx configuration injection Affected: before 1.13.8; before 1.14.4; before 1.15.0 |
| CVE-2025-15566 | 8.8 | Feb 6 | ingress-nginx auth-proxy-set-headers nginx configuration injection Affected: before 1.12.5; before 1.13.1 |
| CVE-2026-24512 | 8.8 | Feb 3 | ingress-nginx auth-method nginx configuration injection Affected: before 1.13.7; before 1.14.3 |
| CVE-2026-1580 | 8.8 | Feb 3 | ingress-nginx auth-method nginx configuration injection Affected: before 1.13.7; before 1.14.3 |
| CVE-2023-5044 | 8.8 | Oct 25 | Code injection via nginx.ingress.kubernetes.io/permanent-redirect annotation Affected: before 1.9.0 |
| CVE-2023-5043 | 8.8 | Oct 25 | Ingress nginx annotation injection causes arbitrary command execution Affected: before 1.9.0 |
| CVE-2021-25745 | 8.1 | May 6 | A security issue was discovered in ingress-nginx where a user that can create or update ingress objects can use the spec.rules[].http.paths[].path field of an Ingress object (in… Affected: before 1.2.0 |
| CVE-2021-25746 | 7.1 | May 6 | A security issue was discovered in ingress-nginx where a user that can create or update ingress objects can use .metadata.annotations in an Ingress object (in the… Affected: before 1.2.0 |
| CVE-2021-25742 | 7.1 | Oct 29 | A security issue was discovered in ingress-nginx where a user that can create or update ingress objects can use the custom snippets feature to obtain all secrets in the cluster Affected: before 0.49.1; 1.0.0 |
| CVE-2026-24514 | 6.5 | Feb 3 | ingress-nginx Admission Controller denial of service Affected: before 1.13.7; before 1.14.3 |
| CVE-2022-4886 | 6.5 | Oct 25 | Ingress-nginx `path` sanitization can be bypassed with `log_format` directive Affected: before 1.8.0 |
| CVE-2021-25748 | 6.5 | May 24 | A security issue was discovered in ingress-nginx where a user that can create or update ingress objects can use a newline character to bypass the sanitization of the… Affected: before 1.2.1 |
| CVE-2020-8553 | 5.9 | Jul 29 | The Kubernetes ingress-nginx component prior to version 0.28.0 allows a user with the ability to create namespaces and to read and create ingress objects to overwrite the password… Affected: before 0.28.0 |
| CVE-2026-24513 | 3.1 | Feb 3 | ingress-nginx auth-url protection bypass Affected: before 1.13.7; before 1.14.3 |
Showing 15