CVE-2026-1580
📋 TL;DR
This vulnerability in ingress-nginx allows attackers to inject malicious configuration via the auth-method annotation, leading to arbitrary code execution within the controller pod. This could result in full cluster compromise since the controller typically has access to all cluster Secrets. All Kubernetes clusters using vulnerable ingress-nginx versions are affected.
💻 Affected Systems
- ingress-nginx
⚠️ Manual Verification Required
This CVE does not have specific version information in our database, so automatic vulnerability detection cannot determine if your system is affected.
Why? The CVE database entry doesn't specify which versions are vulnerable (no version ranges provided by the vendor/NVD).
🔒 Custom verification scripts are available for registered users. Sign up free to download automated test scripts.
- Review the CVE details at NVD
- Check vendor security advisories for your specific version
- Test if the vulnerability is exploitable in your environment
- Consider updating to the latest version as a precaution
⚠️ Risk & Real-World Impact
Worst Case
Full cluster compromise with attacker gaining control of ingress-nginx controller, accessing all cluster Secrets, and potentially pivoting to other workloads.
Likely Case
Attacker executes arbitrary commands in controller context, steals sensitive Secrets, and potentially deploys malicious workloads.
If Mitigated
Limited impact if proper network policies, RBAC restrictions, and admission controllers prevent annotation injection.
🎯 Exploit Status
Requires permissions to create or modify Ingress resources. Exploitation involves crafting malicious auth-method annotation values.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check GitHub issue for specific fixed version
Vendor Advisory: https://github.com/kubernetes/kubernetes/issues/136677
Restart Required: Yes
Instructions:
1. Check current ingress-nginx version. 2. Update to patched version via Helm or YAML manifests. 3. Restart ingress-nginx controller pods. 4. Verify annotation validation is working.
🔧 Temporary Workarounds
Restrict Ingress Creation
allUse Kubernetes RBAC to restrict who can create/modify Ingress resources with annotations
kubectl create role ingress-creator --verb=create,update --resource=ingresses --namespace=production
kubectl create rolebinding restricted-ingress --role=ingress-creator --user=trusted-user --namespace=production
Use Admission Controller
allDeploy OPA/Gatekeeper or Kyverno to validate Ingress annotations and reject malicious auth-method values
# Example Gatekeeper constraint template for ingress-nginx annotations
apiVersion: templates.gatekeeper.sh/v1beta1
kind: ConstraintTemplate
metadata:
name: k8singressannotations
spec:
crd:
spec:
names:
kind: K8sIngressAnnotations
targets:
- target: admission.k8s.gatekeeper.sh
rego: |
package k8singressannotations
violation[{"msg": msg}] {
input.review.object.kind == "Ingress"
input.review.object.metadata.annotations["nginx.ingress.kubernetes.io/auth-method"]
msg := "auth-method annotation is restricted"
}
🧯 If You Can't Patch
- Implement strict RBAC controls to limit who can create/modify Ingress resources
- Deploy network policies to restrict ingress-nginx controller pod egress and limit blast radius
🔍 How to Verify
Check if Vulnerable:
Check if you can create an Ingress with nginx.ingress.kubernetes.io/auth-method annotation containing malicious configurationCheck Version:
kubectl get pods -n ingress-nginx -l app.kubernetes.io/name=ingress-nginx -o jsonpath='{.items[*].spec.containers[*].image}'Verify Fix Applied:
Attempt to create Ingress with malicious auth-method annotation - should be rejected or sanitized📡 Detection & Monitoring
Log Indicators:
- Unusual nginx configuration errors in ingress-nginx logs
- Unexpected processes running in ingress-nginx pods
- Suspicious outbound connections from controller pods
Network Indicators:
- Unusual outbound traffic from ingress-nginx controller pods
- Connections to unexpected external endpoints
SIEM Query:
source="kubernetes" pod_name="ingress-nginx-*" ("auth-method" OR "nginx.ingress.kubernetes.io") | stats count by user, namespace