PT-2026-5761 · Kubernetes+1 · Ingress-Nginx+1

Maxime Escourbiac + 1 · Published 2026-02-02 · Updated 2026-04-19 · CVE-2026-24512

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions ingress-nginx versions prior to v1.13.7 ingress-nginx versions 1.14.0 through 1.14.2

Description The rules.http.paths.path Ingress field in ingress-nginx can be exploited to inject configuration into nginx. This can result in arbitrary code execution within the ingress-nginx controller's context and potential disclosure of Secrets accessible to the controller. In a default installation, the controller has access to all Secrets cluster-wide. The vulnerability lies in the improper handling of the rules.http.paths.path parameter, allowing malicious configuration to be injected.

Recommendations Upgrade ingress-nginx to version 1.13.7 or later. Upgrade ingress-nginx to a version greater than 1.14.2.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

BDU:2026-01287

BIT-NGINX-INGRESS-CONTROLLER-2026-24512

CVE-2026-24512

GHSA-JX8C-56MG-H6VP

GO-2026-4426

SUSE-SU-2026:0403-1

Affected Products

Red Os

Ingress-Nginx

References · 109

• https://bdu.fstec.ru/vul/2026-01287 · Security Note
• https://osv.dev/vulnerability/GO-2026-4426 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-24512 · Security Note
• https://osv.dev/vulnerability/BIT-nginx-ingress-controller-2026-24512 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2026:0403-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-24512 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-jx8c-56mg-h6vp · Vendor Advisory
• https://github.com/kubernetes/kubernetes/issues/136678 · Note
• https://github.com/kubernetes/ingress-nginx · Note
• https://suse.com/security/cve/CVE-2026-22822 · Note
• https://suse.com/security/cve/CVE-2026-24470 · Note
• https://suse.com/security/cve/CVE-2026-1237 · Note
• https://suse.com/security/cve/CVE-2026-20904 · Note
• https://suse.com/security/cve/CVE-2026-23990 · Note
• https://suse.com/support/update/announcement/2026/suse-su-20260403-1 · Note