ingress-nginx
- Software type
- Load balancer
- Total vulnerabilities (90 days)
- Products & ServicesProducts & Services
- SolutionsSolutions
- PricingPricing
- CompanyCompany
- ResourcesResources
en
en
As of 11/12/2026, ingress-nginx recorded 1 security vulnerability in the last 90 days, of which 0 are rated High or Critical. None of these vulnerabilities is actively exploited (KEV) according to CISA's catalog. CyStack recommends that organizations and individual users apply patches as soon as possible.
CyStack does not yet have sufficient official-source data to identify the latest version of ingress-nginx and determine which vulnerabilities affect that version.
CyStack VulnScan continuously discovers assets, validates vulnerabilities, and helps security teams prioritize remediation across the organization.
CVE-2026-116472ingress-nginx mirror-target self-DOSCVE-2026-4342ingress-nginx comment-based nginx configuration injectionCVE-2026-3288Kubernetes ingress-nginx rewrite-target configuration injection enables controller code executionCVE-2025-15566ingress-nginx auth-proxy-set-headers nginx configuration injectionCVE-2026-24514ingress-nginx Admission Controller denial of service| Vulnerability | Exploitation status | Fix | Published | Severity |
|---|---|---|---|---|
CVE-2026-116472ingress-nginx mirror-target self-DOS | Exploitation statusNot confirmed | FixYes |
| SeverityLow |
CVE-2026-4342ingress-nginx comment-based nginx configuration injection | Exploitation statusNot exploited | FixYes | Published03/19/2026 | SeverityHigh |
|---|
CVE-2026-3288Kubernetes ingress-nginx rewrite-target configuration injection enables controller code execution | Exploitation statusActively exploited | FixYes | Published03/09/2026 | SeverityHigh |
|---|
CVE-2025-15566ingress-nginx auth-proxy-set-headers nginx configuration injection | Exploitation statusNot exploited | FixYes | Published02/06/2026 | SeverityHigh |
|---|
CVE-2026-24514ingress-nginx Admission Controller denial of service | Exploitation statusNot exploited | FixYes | Published02/03/2026 | SeverityMedium |
|---|
CVE-2026-24513ingress-nginx auth-url protection bypass | Exploitation statusNot exploited | FixYes | Published02/03/2026 | SeverityLow |
|---|
CVE-2026-24512ingress-nginx auth-method nginx configuration injection | Exploitation statusNot exploited | FixYes | Published02/03/2026 | SeverityHigh |
|---|
CVE-2026-1580ingress-nginx auth-method nginx configuration injection | Exploitation statusNot exploited | FixYes | Published02/03/2026 | SeverityHigh |
|---|
CVE-2025-24514ingress-nginx controller - configuration injection via unsanitized auth-url annotation | Exploitation statusActively exploited | FixYes | Published03/24/2025 | SeverityHigh |
|---|
CVE-2025-24513ingress-nginx controller - auth secret file path traversal vulnerability | Exploitation statusNot exploited | FixYes | Published03/24/2025 | SeverityMedium |
|---|
CVE-2025-1974ingress-nginx admission controller RCE escalation | Exploitation statusActively exploited | FixYes | Published03/24/2025 | SeverityCritical |
|---|
CVE-2025-1098ingress-nginx controller - configuration injection via unsanitized mirror annotations | Exploitation statusNot exploited | FixYes | Published03/24/2025 | SeverityHigh |
|---|
CVE-2025-1097ingress-nginx controller - configuration injection via unsanitized auth-tls-match-cn annotation | Exploitation statusActively exploited | FixYes | Published03/24/2025 | SeverityHigh |
|---|
CVE-2024-7646CVE-2024-7646 | Exploitation statusNot exploited | FixYes | Published08/16/2024 | SeverityHigh |
|---|
CVE-2023-5044Code injection via nginx.ingress.kubernetes.io/permanent-redirect annotation | Exploitation statusNot exploited | FixYes | Published10/25/2023 | SeverityHigh |
|---|
CVE-2023-5043Ingress nginx annotation injection causes arbitrary command execution | Exploitation statusNot confirmed | FixYes | Published10/25/2023 | SeverityHigh |
|---|
CVE-2022-4886Ingress-nginx `path` sanitization can be bypassed with `log_format` directive | Exploitation statusNot exploited | FixYes | Published10/25/2023 | SeverityHigh |
|---|
CVE-2020-8553Kubernetes ingress-nginx Compromise of auth via subset/superset namespace names | Exploitation statusNot confirmed | FixYes | Published07/29/2020 | SeverityMedium |
|---|
18 Results | Page 1 of 1