High severity8.8NVD Advisory· Published Mar 9, 2026· Updated May 6, 2026
CVE-2026-3288
CVE-2026-3288
Description
A security issue was discovered in ingress-nginx where the nginx.ingress.kubernetes.io/rewrite-target Ingress annotation can be used to inject configuration into nginx. This can lead to arbitrary code execution in the context of the ingress-nginx controller, and disclosure of Secrets accessible to the controller. (Note that in the default installation, the controller can access all Secrets cluster-wide.)
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
1Patches
Vulnerability mechanics
References
2- www.openwall.com/lists/oss-security/2026/03/09/8nvdMailing ListThird Party Advisory
- github.com/kubernetes/kubernetes/issues/137560nvdIssue TrackingThird Party Advisory
News mentions
0No linked articles in our index yet.