CVE-2026-1580: ingress-nginx RCE Vulnerability

CVE-2026-1580 Overview

A security issue was discovered in ingress-nginx where the nginx.ingress.kubernetes.io/auth-method Ingress annotation can be used to inject configuration into nginx. This can lead to arbitrary code execution in the context of the ingress-nginx controller, and disclosure of Secrets accessible to the controller. In the default installation, the controller can access all Secrets cluster-wide, significantly amplifying the potential impact of this vulnerability.

Critical Impact

Attackers with permission to create or modify Ingress resources can inject malicious nginx configuration, leading to arbitrary code execution within the ingress-nginx controller pod and potential exposure of all Kubernetes Secrets accessible to the controller.

Affected Products

• ingress-nginx controller (all versions prior to patch)
• Kubernetes clusters using ingress-nginx with default configurations
• Environments where users have permission to create or modify Ingress resources

Discovery Timeline

• 2026-02-03 - CVE-2026-1580 published to NVD
• 2026-02-04 - Last updated in NVD database

Technical Details for CVE-2026-1580

Vulnerability Analysis

This vulnerability stems from improper input validation (CWE-20) in the ingress-nginx controller's handling of the auth-method annotation. The ingress-nginx controller processes Ingress resource annotations to dynamically generate nginx configuration. When the nginx.ingress.kubernetes.io/auth-method annotation is processed, insufficient sanitization allows an attacker to inject arbitrary nginx configuration directives.

The attack is network-accessible and requires only low privileges—specifically, the ability to create or modify Ingress resources within a Kubernetes namespace. No user interaction is required for exploitation. Upon successful exploitation, an attacker gains code execution within the context of the ingress-nginx controller, which by default has broad access to Kubernetes Secrets across all namespaces.

Root Cause

The root cause is improper input validation in the annotation parsing logic. The auth-method annotation value is not properly sanitized before being incorporated into the generated nginx configuration. This allows specially crafted annotation values to break out of the intended configuration context and inject arbitrary directives, including those that can execute code or access sensitive data.

Attack Vector

An attacker with permissions to create or modify Ingress resources can craft a malicious Ingress manifest containing a specially formatted nginx.ingress.kubernetes.io/auth-method annotation. When the ingress-nginx controller processes this resource, the injected configuration becomes part of the active nginx configuration. This can be leveraged to:

1. Execute arbitrary code through nginx modules or Lua scripting capabilities
2. Access environment variables containing sensitive information
3. Read Kubernetes Secrets mounted in the controller pod
4. Potentially pivot to other cluster resources using the controller's service account permissions

For technical details on the vulnerability mechanism, refer to the GitHub Issue Discussion.

Detection Methods for CVE-2026-1580

Indicators of Compromise

• Unusual or malformed nginx.ingress.kubernetes.io/auth-method annotations in Ingress resources
• Unexpected nginx configuration changes or errors in ingress-nginx controller logs
• Anomalous network connections originating from the ingress-nginx controller pod
• Unauthorized access to Kubernetes Secrets detected in audit logs

Detection Strategies

• Implement Kubernetes admission controllers to validate and sanitize Ingress annotations before resource creation
• Monitor ingress-nginx controller logs for configuration parsing errors or unexpected directive inclusions
• Deploy runtime security monitoring to detect code execution or unusual process behavior within controller pods
• Use SentinelOne Singularity Platform for real-time detection of exploitation attempts and post-exploitation activities

Monitoring Recommendations

• Enable Kubernetes audit logging and monitor for Ingress resource creation/modification events
• Set up alerts for annotation values containing suspicious characters or patterns (semicolons, newlines, Lua code)
• Monitor for unexpected outbound connections from ingress-nginx controller pods
• Track Secret access patterns from the ingress-nginx service account

How to Mitigate CVE-2026-1580

Immediate Actions Required

• Audit all existing Ingress resources for suspicious auth-method annotation values
• Implement RBAC policies to restrict which users and service accounts can create or modify Ingress resources
• Deploy admission webhooks (such as OPA Gatekeeper or Kyverno) to validate annotation values
• Consider namespace-scoping the ingress-nginx controller's Secret access if cluster-wide access is not required

Patch Information

Monitor the ingress-nginx project releases for security patches addressing this vulnerability. Check the GitHub Issue Discussion for the latest updates on fix availability. Once a patch is released, upgrade ingress-nginx to the patched version immediately.

Workarounds

• Restrict Ingress resource creation permissions to trusted administrators using Kubernetes RBAC
• Deploy a ValidatingAdmissionWebhook to reject Ingress resources with suspicious annotation patterns
• Implement network policies to limit egress from ingress-nginx controller pods
• Consider temporarily disabling external authentication features if not required

# Example: Restrict Ingress creation with RBAC
kubectl create clusterrole ingress-viewer --verb=get,list,watch --resource=ingresses
kubectl create clusterrolebinding restrict-ingress --clusterrole=ingress-viewer --group=developers

# Example: Check for suspicious annotations in existing Ingress resources
kubectl get ingress -A -o json | jq '.items[] | select(.metadata.annotations["nginx.ingress.kubernetes.io/auth-method"] != null) | {namespace: .metadata.namespace, name: .metadata.name, authMethod: .metadata.annotations["nginx.ingress.kubernetes.io/auth-method"]}'