Recent surveys have revealed that the configuration injection vulnerability CVE-2026-4342 in Ingress-Nginx, a critical component of Kubernetes, still lurks in many production clusters. This vulnerability has a high CVSS score of 8.8 and poses a risk of remote code execution (RCE). Furthermore, a path traversal vulnerability, CVE-2026-3865, has been identified in the CSI Driver for SMB, threatening the security of the entire Kubernetes cluster. Given the importance of Ingress-Nginx in routing traffic from the internet to internal cluster services, these vulnerabilities, if left unaddressed, could lead to severe damage.
Immediate Actions to Take
- ✓Update Kubernetes Ingress-Nginx to the latest patched version provided by the official source. Ensure that the fix for CVE-2026-4342, released in March, has been applied.
- ✓Update Kubernetes CSI Driver for SMB to a patched version. Check relevant Red Hat advisories.
- ✓Monitor security logs for the cluster and related components for any signs of compromise.
Vulnerability Overview and Scope of Impact
CVE-2026-4342 is a configuration injection bug in the Ingress-Nginx controller, which could allow attackers to manipulate settings and ultimately execute arbitrary code remotely. Despite a fix being provided five months ago, many production clusters still have not applied it. As Ingress-Nginx routes traffic for a large portion of Kubernetes clusters worldwide, the impact of this vulnerability is significant.
Meanwhile, CVE-2026-3865 is a path traversal vulnerability present in Kubernetes' CSI Driver for SMB. This vulnerability occurs when the driver reads an attacker-controlled `subDir` value from a PersistentVolume handle and constructs a filesystem path on the SMB share without proper validation. This could allow users with permissions to create PersistentVolumes to access or manipulate files outside of the intended directory.
Specific Impacts and Attack Scenarios
If CVE-2026-4342 is exploited, attackers can illegally manipulate Ingress-Nginx configurations and inject malicious settings, enabling unauthorized access to backend services or execution of arbitrary commands within the cluster. This could lead to severe damage such as exfiltration of confidential information, service disruption, or even a complete takeover of the cluster. This vulnerability is noted as "still lurking in production clusters," indicating a high risk of actual attacks being observed.
An exploitation scenario for CVE-2026-3865 involves an attacker creating a specially crafted PersistentVolume to access or overwrite files at arbitrary paths on the SMB share. This could lead to tampering with system configuration files, leakage of confidential information, or even denial of service.
Impact on Major Distributions
Since Kubernetes Ingress-Nginx is used in many major Kubernetes distributions, the impact of CVE-2026-4342 is widespread. In Kubernetes clusters managed by major cloud providers (such as AWS EKS, Google GKE, Azure AKS) or in on-premises environments, if Ingress-Nginx is in use, it is necessary to check the version and respond promptly. Red Hat has published advisories related to CVE-2026-3865, and patch application based on official information is required, especially in environments like Red Hat OpenShift.
Remediation Steps and Verification Methods
Fixes for Ingress-Nginx are typically provided via official Helm charts or Kubernetes manifests. Depending on your deployment method, follow these steps to check for updates.
# Ingress-Nginxのバージョンを確認
kubectl get deploy -n ingress-nginx ingress-nginx-controller -o=jsonpath='{.spec.template.spec.containers[0].image}'
# Helmを使用している場合、最新バージョンへのアップグレードを検討
helm repo update
helm upgrade ingress-nginx ingress-nginx/ingress-nginx --version <最新のセキュアなバージョン> -n ingress-nginxFor the CSI Driver for SMB, refer to the documentation provided by your Kubernetes distribution or cloud provider to ensure the latest patches have been applied. Red Hat users should consult official advisories and apply recommended updates.
📦