ZeroDay Findings
Sign inSign up

Findings

CVE-2026-3288

A security issue was discovered in ingress-nginx where the Ingress annotation can be used to inject configuration into nginx.

Published Mar 9, 2026 · updated Jun 17, 2026 · kubernetes ingress-nginx

A security issue was discovered in ingress-nginx where the Ingress annotation can be used to inject configuration into nginx. This can lead to arbitrary code execution in the context of the ingress-nginx controller, and disclosure of Secrets accessible to the controller. (Note that in the default installation, the controller can access all Secrets cluster-wide.)

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

  1. Mar 9, 2026 · Kubernetes Security

    Detected

    ingress-nginx rewrite-target nginx configuration injection

  2. Jun 17, 2026 · NIST NVD

    Updated

    A security issue was discovered in ingress-nginx where the Ingress annotation can be used to inject configuration into nginx. This can lead to arbitrary code execution in the context of the ingress-nginx controller, and disclosure of Secrets accessible to the controller. (Note that in the default installation, the controller can access all Secrets cluster-wide.)

Affected

  • cpe kubernetes/ingress-nginxversion unspecified

Sources

  • CVE.orgVulnerability recordCVE-2026-3288

    Official CVE identifier

    cve.org
  • Kubernetes SecurityVendor advisoryCVE-2026-3288

    ingress-nginx rewrite-target nginx configuration injection

    github.com
  • NIST NVDVulnerability recordCVE-2026-3288

    A security issue was discovered in ingress-nginx where the Ingress annotation can be used to inject configuration into nginx. This can lead to arbitrary code execution in the context of the ingress-nginx controller, and disclosure of S

    nvd.nist.gov

References