CVE-2026-3288 - ingress-nginx rewrite-target nginx configuration injection

Back Back to CVE browser

HIGH

ingress-nginx rewrite-target nginx configuration injection

Published Mar 9, 2026

8.8

HIGH

CVSS 3.1

EPSS 0.74%

Description

A security issue was discovered in ingress-nginx where the `nginx.ingress.kubernetes.io/rewrite-target` Ingress annotation can be used to inject configuration into nginx. This can lead to arbitrary code execution in the context of the ingress-nginx controller, and disclosure of Secrets accessible to the controller. (Note that in the default installation, the controller can access all Secrets cluster-wide.)

Affected products

Vendor Kubernetes Product Ingress-Nginx Default
affected
- Version
  0
  Status
  affected
  Constraints
  <1.13.8
- Version
  0
  Status
  affected
  Constraints
  <1.14.4
- Version
  0
  Status
  affected
  Constraints
  <1.15.0

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Kubernetes

Ingress-Nginx

affected

Version	Status	Constraints
0	affected	<1.13.8
0	affected	<1.14.4
0	affected	<1.15.0

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-20

Improper Input Validation

References (4)

http://www.openwall.com/lists/oss-security/2026/03/09/8
Mailing ListThird Party Advisory
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-10360
Advisory
https://github.com/bvabhishek/CVE-2026-3288-lab
exploitMitigationThird Party Advisory
https://github.com/kubernetes/kubernetes/issues/137560
Issue TrackingThird Party Advisory

Link	Providers	Tags
http://www.openwall.com/lists/oss-security/2026/03/09/8		Mailing ListThird Party Advisory
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-10360		Advisory
https://github.com/bvabhishek/CVE-2026-3288-lab		exploitMitigationThird Party Advisory
https://github.com/kubernetes/kubernetes/issues/137560		Issue TrackingThird Party Advisory