Kubernetes ingress-nginx CVE-2026-4342: Exact Preconditions and Fixed Versions

Update: The previous version could be read as an unauthenticated Internet attack and mixed in a separate CSI Driver issue. This article now covers only CVE-2026-4342 using the Kubernetes advisory.

Vulnerability and prerequisite

A user able to create or modify Ingress resources—particularly annotations—can inject NGINX configuration through comments. Successful exploitation can execute code in the ingress-nginx controller context and disclose Kubernetes Secrets accessible to that controller.

Affected and fixed releases

• ▸Affected: ingress-nginx before 1.13.9
• ▸Affected: 1.14.0 through 1.14.4
• ▸Affected: 1.15.0
• ▸Fixed: 1.13.9, 1.14.5, and 1.15.1

Immediate checks

• ✓Inventory controller images and upgrade to a fixed release
• ✓Review identities and RBAC bindings that can create or modify Ingress resources
• ✓Investigate annotation changes, unusual controller processes, and Secret access
• ✓Search all namespaces for forgotten ingress-nginx deployments

kubectl get pods -A -l app.kubernetes.io/name=ingress-nginx -o jsonpath='{range .items[*]}{.metadata.namespace}{"\t"}{.spec.containers[0].image}{"\n"}{end}'
kubectl auth can-i create ingress --all-namespaces --as=<subject>

Primary sources