VYPR
Get started
← All advisories
High severity8.8NVD Advisory· Published Mar 19, 2026· Updated Apr 28, 2026

CVE-2026-4342

CVE-2026-4342

Description

A security issue was discovered in ingress-nginx where a combination of Ingress annotations can be used to inject configuration into nginx. This can lead to arbitrary code execution in the context of the ingress-nginx controller, and disclosure of Secrets accessible to the controller. (Note that in the default installation, the controller can access all Secrets cluster-wide.)

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
k8s.io/ingress-nginxGo
< 0.0.0-20260319175635-5183b7d861370.0.0-20260319175635-5183b7d86137

Affected products

2
  • Kubernetes/Ingress Nginx2 versions
    cpe:2.3:a:kubernetes:ingress-nginx:*:*:*:*:*:*:*:*+ 1 more
    • cpe:2.3:a:kubernetes:ingress-nginx:*:*:*:*:*:*:*:*range: <1.13.9
    • cpe:2.3:a:kubernetes:ingress-nginx:1.15.0:*:*:*:*:*:*:*

Patches

1
5183b7d86137

Template: Remove path from comment. (#14729)

https://github.com/kubernetes/ingress-nginxMarco EbertMar 19, 2026via ghsa
commit
1 file changed · +2 −2
  • rootfs/etc/nginx/template/nginx.tmpl+2 −2 modified
    @@ -619,7 +619,7 @@ http {
     {{ $applyGlobalAuth := shouldApplyGlobalAuth $location $all.Cfg.GlobalExternalAuth.URL }}
     {{ $applyAuthUpstream := shouldApplyAuthUpstream $location $all.Cfg }}
     {{ if and (eq $applyAuthUpstream true) (eq $applyGlobalAuth false) }}
-    ## start auth upstream {{ $server.Hostname }}{{ $location.Path }}
+    ## start auth upstream {{ $server.Hostname }}
     upstream {{ buildAuthUpstreamName $location $server.Hostname }} {
         {{- $externalAuth := $location.ExternalAuth }}
         server {{ extractHostPort $externalAuth.URL }};
@@ -628,7 +628,7 @@ http {
         keepalive_requests {{ $externalAuth.KeepaliveRequests }};
         keepalive_timeout {{ $externalAuth.KeepaliveTimeout }}s;
     }
-    ## end auth upstream {{ $server.Hostname }}{{ $location.Path }}
+    ## end auth upstream {{ $server.Hostname }}
     {{ end }}
     {{ end }}
     {{ end }}

Vulnerability mechanics

Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

5

News mentions

0

No linked articles in our index yet.