CVE-2026-4342
ingress-nginx comment-based nginx configuration injection
HIGH 8.8EPSS 0.6%
A security issue was discovered in ingress-nginx where a combination of Ingress annotations can be used to inject configuration into nginx. This can lead to arbitrary code execution in the context of the ingress-nginx controller, and disclosure of Secrets accessible to the controller. (Note that in the default installation, the controller can access all Secrets cluster-wide.)
- Affected
- Kubernetes · ingress-nginx
- CVSS v3.1 NVD
- 8.8 HIGH
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - EPSS
- 0.63% chance of exploitation in the next 30 days, 49th percentile
- Published
- 2026-03-19
- Updated
- 2026-03-21
Proof-of-concept exploits (1)
- stuartMoorhouse/CVE-2026-43422★ · 2026-03-20
Security advisories
- http://www.openwall.com/lists/oss-security/2026/03/19/9
- advisories/GHSA-f53h-mxv9-cp98
- kubernetes/kubernetes/issues/137893