Arbitrary Code Execution Flaw in Kubernetes ingress-nginx Requires Immediate Patching
Belgium's Centre for Cybersecurity warned organizations to patch Kubernetes ingress-nginx immediately after disclosure of an arbitrary code execution issue affecting the widely used NGINX Ingress Controller. The flaw, tracked as CVE-2026-3288, is a high-severity configuration injection vulnerability that lets an authenticated user with permission to create or modify Ingress resources inject arbitrary nginx directives through a crafted double quote in the Ingress path field, potentially leading to remote code execution and exposure of secrets accessible to the controller.
Sysdig reported that CVE-2026-3288 was fixed on March 9, 2026 and stemmed from an incomplete remediation of the related CVE-2026-24512. According to the company, sanitization had been added to one code path but omitted from another, while built-in validation relied on an incomplete blocklist that attackers could bypass with payloads such as return directives. Affected releases include ingress-nginx versions before v1.13.8, v1.14.4, and v1.15.0; defenders were urged to upgrade, tighten RBAC permissions for Ingress changes, and monitor Kubernetes audit logs for signs of exploitation.
Get ahead of threats like this
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
How this story unfolded
5 events from the most recent confirmed update back to the earliest known activity.
Belgium CCB issues public warning to patch ingress-nginx immediately
On 2026-03-20, Belgium's Centre for Cybersecurity issued an advisory warning about arbitrary code execution in Kubernetes ingress-nginx and urged organizations to patch immediately. The advisory elevated public awareness of the risk following disclosure of the vulnerability.
Sysdig publishes technical analysis and detection guidance
On 2026-03-17, Sysdig published research explaining that CVE-2026-3288 stemmed from incomplete remediation of CVE-2026-24512 and described how DeepInspect validation could be bypassed. The post also provided detection guidance, including monitoring recommendations and a Falco rule based on Kubernetes audit logs.
Ingress-nginx patches CVE-2026-3288 configuration injection flaw
On 2026-03-09, ingress-nginx fixed CVE-2026-3288, a high-severity configuration injection vulnerability that could let an authenticated user who can create or modify Ingress resources inject arbitrary nginx directives. The issue affected releases before v1.13.8, v1.14.4, and v1.15.0 and could lead to remote code execution and disclosure of controller-accessible secrets.
Traficom warns of multiple ingress-nginx RCE flaws and urges upgrades
On 2025-03-25, Finland's Traficom warned that multiple vulnerabilities in the Kubernetes ingress-nginx controller could allow an unauthenticated attacker to execute arbitrary code on vulnerable clusters. The advisory said versions 1.11.4 and earlier and 1.12.0 were affected, urged upgrading to 1.12.1 or 1.11.5, and pointed to Kubernetes mitigation guidance for cases where immediate patching was not possible.
Ingress-nginx flaw CVE-2026-24512 is remediated incompletely
A prior vulnerability, CVE-2026-24512, was addressed in ingress-nginx, but the fix only added sanitization to buildLocation() and omitted buildProxyPass(). This incomplete remediation left a path for configuration injection to persist.
Related entities
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Sources
3 references tracked. Mallory keeps watching after this page renders.
Warning: Arbitrary Code Execution in Kubernetes ingress-nginx, Patch Immediately! | CCB Safeonweb
ccb.belgium.be
Open sourceDetecting CVE-2026-3288 & CVE-2026-24512: Ingress-nginx configuration injection vulnerabilities for Kubernetes | Sysdig
webflow.sysdig.com
Open sourceKuberneteksen ingress-nginx controller -komponentissa useita haavoittuvuuksia | Traficom
kyberturvallisuuskeskus.fi
Open sourceSee the full picture, correlated to your attack surface.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Related stories
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Critical ingress-nginx flaws enable Kubernetes cluster takeover
Kubernetes maintainers disclosed five critical vulnerabilities in **ingress-nginx**, including **`CVE-2025-1974`** with a **CVSS 9.8** rating, warning that attackers on the Pod network could abuse configuration injection in the Validating Admission Controller to take over clusters without credentials. The flaws also affect how ingress-nginx builds **NGINX** configuration from crafted Ingress objects, potentially exposing Secrets available to the controller and leading to full cluster compromise. Patched releases **`ingress-nginx v1.12.1`** and **`v1.11.5`** were issued, and operators were urged to upgrade immediately or temporarily disable the Validating Admission Controller until patching is complete. The disclosure adds to broader concerns about Kubernetes networking and multi-tenant isolation, highlighted by **`CVE-2021-25740`**, an unpatchable issue that lets users with permission to modify **Endpoint** or **EndpointSlice** objects redirect service traffic to unauthorized IP addresses. In shared ingress-controller or load-balancer deployments, that behavior can allow one tenant to steer traffic into another tenant’s workloads and bypass intended network boundaries. Security researchers and vendors said the combined risk is highest in clusters that rely on shared ingress infrastructure with broad Secret access, and recommended tightening EndpointSlice permissions, avoiding shared ingress designs in sensitive environments, and evaluating the **Gateway API** as a safer architecture.
Jun 29, 2026
Critical ingress-nginx flaws enable NGINX config injection, RCE, and admission-controller DoS
Kubernetes maintainers disclosed multiple vulnerabilities in **ingress-nginx** affecting versions `< 1.13.7` and `< 1.14.3`, including **NGINX configuration injection** paths that can lead to **arbitrary code execution** in the ingress-nginx controller context and **Secrets disclosure**. **CVE-2026-24512** allows injection via the Ingress `rules.http.paths.path` field, and **CVE-2026-1580** allows injection via the `nginx.ingress.kubernetes.io/auth-method` annotation; both are rated **CVSS 8.8** and are especially high impact in default deployments where the controller can read Secrets cluster-wide. Recommended mitigations include upgrading to **v1.13.7**, **v1.14.3**, or later, and (as a temporary control) using validating admission policies to reject risky constructs such as `ImplementationSpecific` path types or the `auth-method` annotation. A separate ingress-nginx issue, **CVE-2026-24514** (CVSS 6.5), affects the validating admission controller feature and enables **denial of service** by sending oversized requests that drive memory consumption, potentially killing the controller pod or exhausting node memory. Detection guidance includes monitoring for unusually large requests (multi-megabyte) to the admission controller and suspicious payloads in `rules.http.paths.path` or the `nginx.ingress.kubernetes.io/auth-method` annotation. One referenced item describing **CVE-2025-67601** in the *Rancher CLI* (credential/TLS handling weakness involving `--skip-verify`) is a different product and vulnerability and is not part of the ingress-nginx disclosures.
Jun 29, 2026
Critical NGINX Flaws Expose HTTP/2, gRPC, HTTP/3 and Gateway Fabric Deployments
F5 disclosed multiple high-severity vulnerabilities affecting **NGINX Open Source**, **NGINX Plus**, and related products, including a critical heap-based buffer overflow in `ngx_http_proxy_v2_module` and `ngx_http_grpc_module` tracked as **CVE-2026-42055**. The flaw can be triggered remotely without authentication when HTTP/2 proxying or `grpc_pass` is enabled, `ignore_invalid_headers` is set to `off`, and `large_client_header_buffers` exceeds 2 MB, allowing oversized headers to crash worker processes and potentially enable code execution if ASLR is bypassed. F5 also disclosed **CVE-2026-42530**, a critical use-after-free in the open-source `ngx_http_v3_module` that can be exploited through a crafted HTTP/3 QUIC session to reopen a QPACK encoder stream, again causing worker restarts and possible code execution. A separate issue, **CVE-2026-11311**, affects **NGINX Gateway Fabric** when **NGINX Plus** is used as the data plane, allowing authenticated users with permission to modify relevant CRDs to inject arbitrary NGINX directives through unsanitized values in `NginxProxy.serverTokens` and `AuthenticationFilter.extraAuthArgs`. F5's out-of-band advisory said the exposure spans a broad set of products, including **NGINX Ingress Controller**, **NGINX Instance Manager**, **NGINX App Protect WAF**, **NGINX App Protect DoS**, **F5 WAF for NGINX Instance Manager**, and **F5 DoS for NGINX**. Updated releases, including **nginx 1.31.2** and the stable branch **1.30.3**, were published to address the core NGINX flaws, and defenders were urged to patch affected versions or disable HTTP/3 QUIC where immediate updates are not possible.
Jun 29, 2026