Skip to content

2026-02-04 — ingress-nginx: annotation-driven nginx config injection → controller RCE/secret exposure (CVE-2026-1580)

Product: Kubernetes ingress-nginx (k8s.io/ingress-nginx)

Impact (per advisory): The nginx.ingress.kubernetes.io/auth-method Ingress annotation can be abused to inject configuration into nginx, potentially leading to:

  • Arbitrary code execution in the context of the ingress-nginx controller
  • Disclosure of Kubernetes Secrets accessible to the controller (often cluster-wide in default installs)

Why this matters

Ingress controllers sit at the edge, and ingress-nginx commonly has broad permissions (including access to Secrets used for TLS, auth, and service credentials). If a namespace user who can create/modify Ingress objects can inject nginx config, this becomes a high-leverage path to cluster compromise.

Affected / fixed versions

Per GitHub advisory: - Affected: < 1.13.7 - Affected: >= 1.14.0, < 1.14.3 - Fixed: 1.13.7 and 1.14.3

  • Patch/upgrade immediately to 1.13.7+ or 1.14.3+.
  • Reduce blast radius (defense-in-depth):
  • Ensure the controller is scoped (RBAC + namespace scoping) and does not have unnecessary access to Secrets.
  • Restrict who can create/modify Ingress resources (RBAC) in namespaces.
  • If you run a validating admission policy/webhook for Ingress, consider explicitly denylisting dangerous annotations (or allowlisting only the annotations you need).

Detection / hunting ideas

  • Audit recent changes to Ingress objects for unexpected or novel annotations.
  • Review controller logs for parsing/config reload anomalies around the time of Ingress updates.
  • If you can, diff generated nginx config for suspicious directives that do not match your normal patterns.

References