oss-security - [kubernetes] CVE-2026-3288: ingress-nginx rewrite-target nginx configuration injection

Follow @Openwall on Twitter for new release announcements and other news

Message-ID: <CAM62Sm+vbcd9O8JJ4MA-hhbaY2OxK9+PxQdECVueZYxEXqZFVw@mail.gmail.com>
Date: Mon, 9 Mar 2026 12:29:47 -0500
From: Tabitha Sable <tabitha.c.sable@...il.com>
To: oss-security@...ts.openwall.com
Subject: [kubernetes] CVE-2026-3288: ingress-nginx rewrite-target nginx
 configuration injection

Hello Kubernetes Community,

A security issue was discovered in ingress-nginx where the
nginx.ingress.kubernetes.io/rewrite-target Ingress annotation can be used
to inject configuration into nginx. This can lead to arbitrary code
execution in the context of the ingress-nginx controller, and disclosure of
Secrets accessible to the controller. (Note that in the default
installation, the controller can access all Secrets cluster-wide.)

This issue has been rated **HIGH** ([CVSS calculator](
https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H),
score: 8.8), and assigned **CVE-2026-3288**

### Am I vulnerable?

This issue affects ingress-nginx. If you do not have ingress-nginx
installed on your cluster, you are not affected. You can check this by
running `kubectl get pods --all-namespaces --selector
app.kubernetes.io/name=ingress-nginx`.

#### Affected Versions

- ingress-nginx: < 1.13.8
- ingress-nginx: < 1.14.4
- ingress-nginx: < 1.15.0

### How do I mitigate this vulnerability?

Prior to upgrading, this vulnerability can be mitigated by using admission
control to block the use of the rewrite-target annotation.

#### Fixed Versions

- ingress-nginx: 1.13.8
- ingress-nginx: 1.14.4
- ingress-nginx: 1.15.0

#### How to upgrade?

To upgrade, refer to the documentation: [Upgrading Ingress-nginx](
https://kubernetes.github.io/ingress-nginx/deploy/upgrade/)

### Detection

Suspicious data within the `rules.http.paths.path` field of an Ingress
resource could indicate an attempt to exploit this vulnerability.

If you find evidence that this vulnerability has been exploited, please
contact security@...ernetes.io

See the GitHub issue for more details:
https://github.com/kubernetes/kubernetes/issues/137560

#### Acknowledgements

This vulnerability was reported by Kai Aizen

Thank You,

Tabitha Sable on behalf of the Kubernetes Security Response Committee

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.