Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
8.8

Ingress-Nginx Configuration Injection Allows Malicious Code Execution

CVE-2026-3288 · published 8 months ago
Summary

A vulnerability in Ingress-Nginx allows an attacker to inject malicious code into the configuration, potentially leading to unauthorized access to sensitive information and system compromise. This affects Kubernetes environments using Ingress-Nginx, so it's essential to review and restrict annotations to prevent exploitation. To mitigate this issue, review and limit access to Ingress annotations and consider implementing additional security measures.

What to do
  • Update nginx-ingress-controller to version 1.14.4.
Affected software
Ecosystem VendorProductAffected versions
Bitnami – nginx-ingress-controller >= 1.14.0, < 1.14.4
Fix: upgrade to 1.14.4
– kubernetes ingress-nginx < 1.13.8
>= 1.14.0, < 1.14.4
cpe:2.3:a:kubernetes:ingress-nginx:*:*:*:*:*:*:*:*
Original advisory text
ingress-nginx rewrite-target nginx configuration injection
A security issue was discovered in ingress-nginx where the `nginx.ingress.kubernetes.io/rewrite-target` Ingress annotation can be used to inject configuration into nginx. This can lead to arbitrary code execution in the context of the ingress-nginx controller, and disclosure of Secrets accessible to the controller. (Note that in the default installation, the controller can access all Secrets cluster-wide.)
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker full control
Severity
8.8 High
Exploitation
7% chance of attack within 30 days
Type
CWE-20Improper Input Validation
Timeline
Published9 Mar 2026
Updated4 Nov 2026
First seen9 Mar 2026
Sources
CVE-2026-3288 · NVD
BIT-nginx-ingress-controller-2026-3288 · OSV
CVE-2026-3288 · OSV
Track software like this
Free during beta