PT-2026-5760 · Kubernetes+1 · Ingress-Nginx+1

Published

2026-02-02

·

Updated

2026-03-10

·

CVE-2026-1580

CVSS v2.0

9.0

High

VectorAV:N/AC:L/Au:S/C:C/I:C/A:C
Name of the Vulnerable Software and Affected Versions ingress-nginx versions prior to v1.13.7 ingress-nginx versions 1.14.0 through 1.14.3
Description The nginx.ingress.kubernetes.io/auth-method Ingress annotation in ingress-nginx can be exploited to inject configuration into nginx. This can lead to arbitrary code execution within the ingress-nginx controller's context. Additionally, it may result in the disclosure of Secrets accessible to the controller, which, in a default installation, includes all cluster-wide Secrets. An attacker with Ingress creation permissions can bypass validation to inject arbitrary Nginx configuration and potentially steal controller credentials.
Recommendations Versions prior to v1.13.7 should be updated to a later, secure version. Versions 1.14.0 through 1.14.3 should be updated to a later, secure version.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

BDU:2026-03565
BIT-NGINX-INGRESS-CONTROLLER-2026-1580
CVE-2026-1580
GHSA-9H3P-52VH-959W
GO-2026-4423
SUSE-SU-2026:0403-1

Affected Products

Red Os
Ingress-Nginx