CVE-2026-24512

Name of the Vulnerable Software and Affected Versions ingress-nginx versions prior to v1.13.7 ingress-nginx versions 1.14.0 through 1.14.2

Description The rules.http.paths.path Ingress field in ingress-nginx can be exploited to inject configuration into nginx. This can result in arbitrary code execution within the ingress-nginx controller's context and potential disclosure of Secrets accessible to the controller. In a default installation, the controller has access to all Secrets cluster-wide. The vulnerability lies in the improper handling of the rules.http.paths.path parameter, allowing malicious configuration to be injected.

Recommendations Upgrade ingress-nginx to version 1.13.7 or later. Upgrade ingress-nginx to a version greater than 1.14.2.