CVE-2026-24512: ingress-nginx RCE Vulnerability

CVE-2026-24512 Overview

A security issue was discovered in ingress-nginx where the rules.http.paths.path Ingress field can be used to inject configuration into nginx. This can lead to arbitrary code execution in the context of the ingress-nginx controller, and disclosure of Secrets accessible to the controller. In the default installation, the controller can access all Secrets cluster-wide, significantly amplifying the impact of this vulnerability.

Critical Impact

Attackers with the ability to create or modify Ingress resources can achieve remote code execution within the ingress-nginx controller pod and exfiltrate all Kubernetes Secrets accessible to the controller, potentially compromising the entire cluster.

Affected Products

• ingress-nginx controller (all versions prior to patched releases)
• Kubernetes clusters using ingress-nginx with default configurations
• Any environment where users can create or modify Ingress resources

Discovery Timeline

• 2026-02-03 - CVE-2026-24512 published to NVD
• 2026-02-04 - Last updated in NVD database

Technical Details for CVE-2026-24512

Vulnerability Analysis

This vulnerability is classified under CWE-20 (Improper Input Validation) and represents a configuration injection flaw in the ingress-nginx controller. The ingress-nginx controller dynamically generates nginx configuration based on Ingress resources defined in the Kubernetes cluster. When processing the rules.http.paths.path field, the controller fails to properly sanitize user-provided input before incorporating it into the nginx configuration file.

The attack is network-accessible and requires low privileges, specifically the ability to create or modify Ingress resources within the cluster. This could be achieved by a malicious authenticated user with standard deployment permissions, a compromised CI/CD pipeline, or through exploitation of another vulnerability that grants Ingress resource manipulation capabilities.

Root Cause

The root cause is insufficient input validation on the rules.http.paths.path field in Ingress resource specifications. The ingress-nginx controller directly interpolates this field value into the generated nginx configuration without proper escaping or validation against configuration injection patterns. This allows specially crafted path values to break out of the intended configuration context and inject arbitrary nginx directives.

Attack Vector

An attacker with permissions to create or modify Ingress resources can craft a malicious Ingress specification with a specially formatted rules.http.paths.path value. When the ingress-nginx controller processes this Ingress resource, it generates an nginx configuration that includes the injected directives.

The attacker can leverage nginx's ability to execute external commands or Lua scripts to achieve code execution within the controller's container context. Since the ingress-nginx controller typically runs with elevated Kubernetes API permissions and, in default configurations, has access to all Secrets cluster-wide, successful exploitation allows the attacker to:

1. Execute arbitrary code within the controller pod
2. Access and exfiltrate Kubernetes Secrets including service account tokens, TLS certificates, and application credentials
3. Potentially pivot to other cluster resources using the controller's service account permissions

The vulnerability is exploited by submitting a malicious Ingress manifest via kubectl apply or the Kubernetes API. Technical details regarding specific injection payloads can be found in the GitHub Kubernetes Issue.

Detection Methods for CVE-2026-24512

Indicators of Compromise

• Unusual Ingress resources with suspicious characters in the rules.http.paths.path field (e.g., newlines, semicolons, or Lua code patterns)
• Unexpected network connections originating from the ingress-nginx controller pod
• Anomalous Secret access patterns in Kubernetes audit logs from the ingress-nginx service account
• Nginx configuration files containing unexpected directives or Lua code blocks

Detection Strategies

• Enable and monitor Kubernetes audit logging for Ingress resource creation and modification events
• Implement admission controllers (e.g., OPA Gatekeeper, Kyverno) to validate Ingress path fields against injection patterns
• Deploy runtime security monitoring to detect anomalous process execution within ingress-nginx pods
• Configure alerts for Secret access events from the ingress-nginx controller service account

Monitoring Recommendations

• Monitor ingress-nginx controller logs for configuration parsing errors or unexpected behavior
• Implement network segmentation monitoring to detect unusual egress traffic from the controller namespace
• Set up file integrity monitoring on nginx configuration directories within the controller pod
• Review and baseline normal Secret access patterns to identify deviations

How to Mitigate CVE-2026-24512

Immediate Actions Required

• Review all existing Ingress resources in your cluster for suspicious path field values
• Implement Kubernetes admission policies to restrict special characters in Ingress path specifications
• Apply the principle of least privilege to the ingress-nginx controller's service account, limiting Secret access scope
• Consider network policies to restrict egress from the ingress-nginx namespace

Patch Information

Organizations should monitor the official ingress-nginx project and the GitHub Kubernetes Issue for patch announcements. When patches become available, upgrade the ingress-nginx controller to the remediated version following the project's upgrade procedures.

Workarounds

• Deploy admission control policies using OPA Gatekeeper or Kyverno to validate and reject Ingress resources with suspicious path patterns
• Restrict RBAC permissions for creating or modifying Ingress resources to trusted administrators only
• Configure the ingress-nginx controller's service account with minimal required Secret access rather than cluster-wide permissions
• Implement network policies to limit the controller's ability to make outbound connections

# Example: Restrict ingress-nginx service account Secret access
# Create a limited Role instead of using ClusterRole
kubectl create role ingress-nginx-limited \
  --verb=get,list,watch \
  --resource=secrets \
  --namespace=ingress-nginx

# Bind only to specific namespaces rather than cluster-wide
kubectl create rolebinding ingress-nginx-secrets \
  --role=ingress-nginx-limited \
  --serviceaccount=ingress-nginx:ingress-nginx \
  --namespace=ingress-nginx