CVE-2026-3288: Ingress-NGINX RCE Vulnerability

CVE-2026-3288 Overview

A security vulnerability has been identified in ingress-nginx, a widely-used Kubernetes Ingress controller. The flaw exists in the nginx.ingress.kubernetes.io/rewrite-target Ingress annotation, which can be exploited to inject arbitrary nginx configuration directives. Successful exploitation allows attackers to achieve arbitrary code execution within the context of the ingress-nginx controller and gain unauthorized access to Kubernetes Secrets accessible to the controller.

Critical Impact

In default installations, the ingress-nginx controller can access all Secrets cluster-wide, making this vulnerability particularly dangerous for Kubernetes environments. Attackers with the ability to create or modify Ingress resources can compromise the entire cluster's secret store.

Affected Products

• ingress-nginx (Kubernetes Ingress Controller)
• Kubernetes clusters using ingress-nginx with default configurations
• Container environments with ingress-nginx deployed

Discovery Timeline

• 2026-03-09 - CVE-2026-3288 published to NVD
• 2026-03-11 - Last updated in NVD database

Technical Details for CVE-2026-3288

Vulnerability Analysis

This vulnerability stems from improper input validation (CWE-20) in the ingress-nginx controller's handling of the rewrite-target annotation. The annotation is designed to allow users to specify URL rewrite rules for incoming HTTP requests, but insufficient sanitization of the annotation value allows malicious actors to inject arbitrary nginx configuration directives.

The ingress-nginx controller processes Ingress resources and generates nginx configuration files dynamically. When the nginx.ingress.kubernetes.io/rewrite-target annotation is parsed, the controller fails to properly validate and sanitize the input, allowing an attacker to break out of the intended configuration context and inject custom nginx directives.

Once arbitrary configuration is injected, attackers can leverage nginx's Lua scripting capabilities or other features to execute arbitrary code. Given that the controller pod typically has access to a service account with broad permissions—including cluster-wide Secret access in default deployments—this code execution can lead to complete compromise of sensitive cluster data.

Root Cause

The root cause is improper input validation in the annotation parsing logic. The rewrite-target annotation value is incorporated into the generated nginx configuration without adequate escaping or validation of special characters and nginx configuration syntax elements. This allows attackers to terminate the expected configuration block and inject additional directives.

Attack Vector

Exploitation requires network access and the ability to create or modify Ingress resources in the target Kubernetes cluster. An attacker with low-level privileges to create Ingress objects can craft a malicious Ingress manifest with a specially crafted rewrite-target annotation value containing nginx configuration injection payloads.

The attack flow involves:

1. Creating an Ingress resource with a malicious rewrite-target annotation
2. The ingress-nginx controller processes the Ingress and generates an nginx configuration containing the injected directives
3. nginx reloads with the malicious configuration, executing attacker-controlled code
4. The attacker leverages the controller's service account to access Kubernetes Secrets

The vulnerability is exploitable from the network without user interaction, though it requires authenticated access to the Kubernetes API with permissions to manage Ingress resources.

Detection Methods for CVE-2026-3288

Indicators of Compromise

• Unusual or malformed rewrite-target annotations in Ingress resources containing special characters or nginx configuration syntax
• Unexpected nginx configuration blocks or Lua code in the ingress-nginx controller's generated configuration
• Anomalous API calls from the ingress-nginx controller pod to access Secrets outside normal operational patterns
• Suspicious processes spawned within the ingress-nginx controller container

Detection Strategies

• Implement admission controllers or OPA/Gatekeeper policies to validate and restrict Ingress annotation values before they are applied to the cluster
• Monitor Kubernetes audit logs for creation or modification of Ingress resources with suspicious annotation values
• Deploy runtime security monitoring within the ingress-nginx controller pods to detect code execution anomalies
• Configure alerts for unusual Secret access patterns from the ingress-nginx service account

Monitoring Recommendations

• Enable Kubernetes audit logging with detailed request/response recording for Ingress resource operations
• Implement log aggregation and analysis for nginx error logs and configuration reload events
• Deploy network monitoring to detect unexpected outbound connections from the ingress-nginx controller
• Use container runtime security tools to monitor for process injection or unexpected binary execution within controller pods

How to Mitigate CVE-2026-3288

Immediate Actions Required

• Review all existing Ingress resources in your cluster for suspicious rewrite-target annotation values
• Implement RBAC restrictions to limit which users and service accounts can create or modify Ingress resources
• Consider disabling or restricting the use of the rewrite-target annotation via admission controller policies until patching is complete
• Reduce the ingress-nginx controller's service account permissions to follow the principle of least privilege, limiting Secret access to only those required for TLS termination

Patch Information

Security patches addressing this vulnerability are being tracked in the Kubernetes GitHub Issue Discussion. Administrators should monitor the official ingress-nginx releases and apply updates as soon as they become available. The Openwall Security Announcement provides additional details on the vulnerability disclosure.

Workarounds

• Deploy OPA Gatekeeper or Kyverno policies to validate Ingress annotations and reject resources with potentially malicious values in rewrite-target
• Restrict the ingress-nginx controller's service account using RBAC to limit Secret access to only specific namespaces or individual Secrets required for operation
• Use network policies to limit the ingress-nginx controller's network access to only necessary services
• Consider deploying the ingress-nginx controller with read-only root filesystem and dropping all Linux capabilities to reduce the impact of code execution

# Example: Restrict ingress-nginx service account Secret access
# Create a Role limiting Secret access to a specific namespace
kubectl create role ingress-nginx-secrets \
  --namespace=ingress-tls \
  --verb=get,list,watch \
  --resource=secrets

# Bind the restricted role to the ingress-nginx service account
kubectl create rolebinding ingress-nginx-secrets-binding \
  --role=ingress-nginx-secrets \
  --serviceaccount=ingress-nginx:ingress-nginx \
  --namespace=ingress-tls