PT-2026-6527 · Go · K8S.Io/Ingress-Nginx

Published 2026-02-05 · Updated 2026-02-05

OSV

ingress-nginx's nginx.ingress.kubernetes.io/auth-method Ingress annotation can be used to inject configuration into nginx in k8s.io/ingress-nginx.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: k8s.io/ingress-nginx before v1.13.7, from v1.14.0 before v1.14.3.

Related Identifiers

GO-2026-4423

Affected Products

K8S.Io/Ingress-Nginx

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2026-1580 · Security Note
• https://osv.dev/vulnerability/GO-2026-4423 · Vendor Advisory
• https://github.com/kubernetes/kubernetes/issues/136677 · Note
• https://github.com/advisories/GHSA-9h3p-52vh-959w · Note