IP-DB.com
Türkçe English Deutsch Español
Anmelden API-Schlüssel holen
8.8Hoch

CVE-2026-3288ingress-nginx rewrite-target nginx configuration injection

Kubernetes ingress-nginx Veröffentlicht: (vor 8 Monaten)

Beschreibung

A security issue was discovered in ingress-nginx where the `nginx.ingress.kubernetes.io/rewrite-target` Ingress annotation can be used to inject configuration into nginx. This can lead to arbitrary code execution in the context of the ingress-nginx controller, and disclosure of Secrets accessible to the controller. (Note that in the default installation, the controller can access all Secrets cluster-wide.)

Schwachstellentyp (CWE): CWE-20

Daten: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Wiedergegeben wie in der Quelle, auf Englisch.

Betroffene Produkte und Versionen

HerstellerProduktVersionen
Kubernetes ingress-nginx < 1.13.8, < 1.14.4, < 1.15.0

Referenzen und Patches

CPE-Treffer (NVD) (2)
  • cpe:2.3:a:kubernetes:ingress-nginx:*:*:*:*:*:*:*:* < 1.13.8
  • cpe:2.3:a:kubernetes:ingress-nginx:*:*:*:*:*:*:*:* ≥ 1.14.0 < 1.14.4

Neue CVEs im selben Produkt — Kubernetes

2.7Niedrig
CVE-2026-116472

ingress-nginx mirror-target self-DOS

Kubernetes ingress-nginx; SUSE Rancher Prime RKE2 ingress-nginx

A security issue was discovered in ingress-nginx where a user with permission to create an Ingress may be able to cause denial of service of the ingress-nginx data plane, or possibly redirect traffic from other Ingresses. Kubernetes clusters are only affected…

5.8Mittel
CVE-2026-76654

Subpath symlinking on Windows nodes permits NTLM coercion

Kubernetes Kubernetes

An NTLM coercion vulnerability exists on Windows nodes when the subPath supplied in a pod's volumeMounts is set to a symbolic link that points to an attacker-controlled network share. When a kubelet resolves symlinks, it does not reject a target that resolves…

2.7Niedrig
CVE-2026-15687

Path traversal via non-tar copyDirectoryFromPod

Kubernetes kubernetes-client/java

A security issue was discovered in the Kubernetes Java client library where a compromised pod may be able to create new files in arbitrary locations on the client machine executing copy operations via non-tar copyDirectoryFromPod when enableTarCompressing is false.