CVE-2026-3288

Name of the Vulnerable Software and Affected Versions ingress-nginx versions prior to 1.13.7 ingress-nginx versions prior to 1.14.3

Description A security issue exists due to insufficient input validation when processing Ingress resource annotations. An attacker can use the nginx.ingress.kubernetes.io/rewrite-target annotation to inject arbitrary configuration directives into the nginx.conf file. This configuration injection can lead to arbitrary code execution within the context of the ingress-nginx controller and the disclosure of Secrets accessible to the controller, which, in default installations, may include all Secrets cluster-wide.

Recommendations Update ingress-nginx to version 1.13.7 or later. Update ingress-nginx to version 1.14.3 or later. As a temporary mitigation, restrict or avoid using the nginx.ingress.kubernetes.io/rewrite-target annotation.