Advisory Database
  • Advisories
  • Dependency Scanning
  1. golang
  2. ›
  3. k8s.io/ingress-nginx
  4. ›
  5. CVE-2026-4342

CVE-2026-4342: ingress-nginx comment-based nginx configuration injection

March 20, 2026

A security issue was discovered in ingress-nginx where a combination of Ingress annotations can be used to inject configuration into nginx. This can lead to arbitrary code execution in the context of the ingress-nginx controller, and disclosure of Secrets accessible to the controller. (Note that in the default installation, the controller can access all Secrets cluster-wide.)

References

  • github.com/advisories/GHSA-f53h-mxv9-cp98
  • github.com/kubernetes/ingress-nginx
  • github.com/kubernetes/ingress-nginx/commit/5183b7d861377a9a2f6d2acaf44f8f6abd5cd0aa
  • github.com/kubernetes/kubernetes/issues/137893
  • nvd.nist.gov/vuln/detail/CVE-2026-4342

Code Behaviors & Features

Detect and mitigate CVE-2026-4342 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →

Affected versions

All versions before 0.0.0-20260319175635-5183b7d86137

Fixed versions

  • 0.0.0-20260319175635-5183b7d86137

Solution

Upgrade to version 0.0.0-20260319175635-5183b7d86137 or above.

Impact 8.8 HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Learn more about CVSS

Weakness

  • CWE-20: Improper Input Validation

Source file

go/k8s.io/ingress-nginx/CVE-2026-4342.yml

Spotted a mistake? Edit the file on GitLab.

  • Site Repo
  • About GitLab
  • Terms
  • Privacy Statement
  • Contact

Page generated Tue, 24 Mar 2026 12:17:11 +0000.