CVE-2026-4342
A security issue was discovered in ingress-nginx where a combination of Ingress annotations can be used to inject configuration into nginx.
Published Mar 19, 2026 · updated Jun 17, 2026 · kubernetes nginx ingress controller
A security issue was discovered in ingress-nginx where a combination of Ingress annotations can be used to inject configuration into nginx. This can lead to arbitrary code execution in the context of the ingress-nginx controller, and disclosure of Secrets accessible to the controller. (Note that in the default installation, the controller can access all Secrets cluster-wide.)
Code
The project this record applies to. Exploit listings stay in References.
Timeline
Detection, updates, and resolution for this record.
Mar 19, 2026 · Kubernetes Security
Detected
ingress-nginx comment-based nginx configuration injection
Jun 17, 2026 · NIST NVD
Updated
A security issue was discovered in ingress-nginx where a combination of Ingress annotations can be used to inject configuration into nginx. This can lead to arbitrary code execution in the context of the ingress-nginx controller, and disclosure of Secrets accessible to the controller. (Note that in the default installation, the controller can access all Secrets cluster-wide.)
Affected
- cpe kubernetes/nginx ingress controllerversion unspecified
- cpe kubernetes/nginx ingress controller1.15.0
Sources
- Kubernetes SecurityVendor advisoryCVE-2026-4342
ingress-nginx comment-based nginx configuration injection
github.com - NIST NVDVulnerability recordCVE-2026-4342
A security issue was discovered in ingress-nginx where a combination of Ingress annotations can be used to inject configuration into nginx. This can lead to arbitrary code execution in the context of the ingress-nginx controller, and disclosure of Secrets accessible to the contro
nvd.nist.gov