CVE-2026-1580

Name of the Vulnerable Software and Affected Versions ingress-nginx versions prior to v1.13.7 ingress-nginx versions 1.14.0 through 1.14.3

Description The nginx.ingress.kubernetes.io/auth-method Ingress annotation in ingress-nginx can be exploited to inject configuration into nginx. This can lead to arbitrary code execution within the ingress-nginx controller's context. Additionally, it may result in the disclosure of Secrets accessible to the controller, which, in a default installation, includes all cluster-wide Secrets. An attacker with Ingress creation permissions can bypass validation to inject arbitrary Nginx configuration and potentially steal controller credentials.

Recommendations Versions prior to v1.13.7 should be updated to a later, secure version. Versions 1.14.0 through 1.14.3 should be updated to a later, secure version.