CVE-2026-24513: Ingress-Nginx Auth Bypass Vulnerability

CVE-2026-24513 Overview

A security issue was discovered in ingress-nginx where the protection afforded by the auth-url Ingress annotation may not be effective in the presence of a specific misconfiguration. If the ingress-nginx controller is configured with a default custom-errors configuration that includes HTTP errors 401 or 403, and if the configured default custom-errors backend is defective and fails to respect the X-Code HTTP header, then an Ingress with the auth-url annotation may be accessed even when authentication fails.

This vulnerability is classified as CWE-754 (Improper Check for Unusual or Exceptional Conditions), where the system fails to properly handle exceptional conditions that could lead to authentication bypass scenarios.

Critical Impact

Authentication mechanisms may be bypassed when a defective external custom-errors backend is configured, potentially allowing unauthorized access to protected resources in Kubernetes environments.

Affected Products

• ingress-nginx controller with custom-errors configuration
• Kubernetes deployments using auth-url Ingress annotation
• Environments with external custom-errors backends configured for HTTP 401/403 errors

Discovery Timeline

• 2026-02-03 - CVE-2026-24513 published to NVD
• 2026-02-04 - Last updated in NVD database

Technical Details for CVE-2026-24513

Vulnerability Analysis

The vulnerability exists in ingress-nginx's authentication flow when combined with a misconfigured custom-errors backend. Under normal operation, when authentication fails via the auth-url annotation, ingress-nginx returns a 401 or 403 HTTP response. The custom-errors backend is responsible for handling these error codes and should respect the X-Code header to properly propagate the authentication failure.

However, when an administrator configures an external custom-errors backend that fails to properly handle the X-Code HTTP header, the authentication failure response may not be correctly processed. This can result in the request being forwarded to the backend application despite the authentication check failing, effectively bypassing the intended access controls.

It is important to note that the built-in custom-errors backend works correctly. This vulnerability only manifests when an administrator specifically configures ingress-nginx with a broken external component that does not properly implement the expected error handling behavior.

Root Cause

The root cause is improper validation of exceptional conditions (CWE-754) in the error handling chain. The ingress-nginx controller trusts that the configured custom-errors backend will correctly interpret and act upon the X-Code HTTP header. When this contract is violated by a defective external component, the authentication decision is not properly enforced, leading to potential access control bypass.

Attack Vector

The attack requires the following conditions to be present:

1. The ingress-nginx controller must be configured with a default custom-errors configuration
2. The custom-errors configuration must include handling for HTTP status codes 401 or 403
3. The configured custom-errors backend must be defective and fail to respect the X-Code HTTP header
4. An Ingress resource must be configured with the auth-url annotation for external authentication

When all conditions are met, an attacker with network access to the ingress endpoint could potentially bypass authentication by exploiting the improper error handling in the custom-errors backend. The attack requires low privileges and is network-accessible, though the high attack complexity reflects the specific misconfiguration requirements.

Detection Methods for CVE-2026-24513

Indicators of Compromise

• Unexpected successful access to resources protected by auth-url annotation
• Discrepancies between authentication service logs (showing failures) and backend access logs (showing successful requests)
• Custom-errors backend logs showing malformed or missing X-Code header handling

Detection Strategies

• Review ingress-nginx configurations for custom-errors backends handling 401/403 status codes
• Audit external custom-errors backend implementations to verify proper X-Code header handling
• Compare authentication failure rates with actual denied request counts
• Implement logging at both the authentication service and backend application layers

Monitoring Recommendations

• Enable detailed access logging on ingress-nginx controllers to correlate authentication decisions with request outcomes
• Monitor for requests that bypass authentication by comparing auth service responses with backend access patterns
• Set up alerts for configuration changes to custom-errors settings in ingress-nginx deployments
• Implement security information and event management (SIEM) rules to detect authentication bypass patterns

How to Mitigate CVE-2026-24513

Immediate Actions Required

• Review ingress-nginx configurations to identify any custom-errors backend configurations
• Verify that any configured custom-errors backends properly respect the X-Code HTTP header
• Consider using the built-in custom-errors backend which correctly handles authentication failures
• Audit access logs for any potential unauthorized access during the exposure window

Patch Information

Administrators should review the GitHub Kubernetes Issue Discussion for the latest guidance and updates regarding this vulnerability. The recommended remediation is to either use the built-in custom-errors backend or ensure any external custom-errors backend properly implements X-Code header handling.

Workarounds

• Replace defective external custom-errors backends with the built-in ingress-nginx custom-errors backend
• Remove 401 and 403 from the custom-errors configuration if external error handling is not required
• Implement additional authorization checks at the application layer as defense-in-depth
• Consider using network policies to restrict access to sensitive endpoints while investigating the configuration

# Verify custom-errors configuration in ingress-nginx
kubectl get configmap -n ingress-nginx ingress-nginx-controller -o yaml | grep -A5 "custom-http-errors"

# Check if external custom-errors backend is configured
kubectl get pods -n ingress-nginx -l app.kubernetes.io/component=default-backend