CVE-2023-5043

CVE-2023-5043 Ingress nginx annotation injection causes arbitrary command execution 1. Create Ingress can be created without Service and Pod root@kitploit: apiVersion: networking.k8s.io/v1 kind: Ingress metadata: name: ingress-exploit annotations: kubernetes.io/ingress.class: "nginx"...

CVE-2024-7646

CVE-2024-7646 PoC CVE-2024-7646 root@kitploit: apiVersion: networking.k8s.io/v1 kind: Ingress metadata: name: example-ingress annotations: nginx.ingress.kubernetes.io/server-snippet: | addheader X-Pwn-Header "Pwn\r\n HTTP/1.1 200 OK Content-Type: text/html alert'XSS'; --------"; return 200 "PWNed...

ingressnightmare-detection-poc

IngressNightmare Detection Tool Overview This tool provides a non-intrusive detection capability for the IngressNightmare vulnerability chain CVE-2025-1974 affecting Ingress NGINX Controller. It specifically leverages the auth-url annotation injection vector CVE-2025-24514 to verify the presence ...

CVE-2025-1974

🚨 Prueba de Inyección de Registros a través del Controlador de Admisión de Ingress-NGINX 🧠 Resumen Este script prueba vulnerabilidades de inyección de anotaciones en clústeres de Kubernetes que utilizan el Controlador de Ingress NGINX. Está diseñado solo para fines de detección en relación con...

CVE-2026-71404 Rancher: Ownership-less ClusterRole overwrite via attacker-controlled cr-name annotation on GlobalRole

A flaw was found in Rancher Manager. The GlobalRole controller derived the target ClusterRole name from the user-settable authz.management.cattle.io/cr-name annotation and overwrote that object's rules without verifying ownership. A user with delegated GlobalRole create or update permission could...

PT-2026-85062

A flaw was found in Rancher Manager. The GlobalRole controller derived the target ClusterRole name from the user-settable authz.management.cattle.io/cr-name annotation and overwrote that object's rules without verifying ownership. A user with delegated GlobalRole create or update permission could...

CVE-2026-73041 SiYuan before v3.7.4 Remote Code Execution via PDF Annotations

SiYuan versions before v3.7.4 fail to validate or escape annotation fields written to disk by the setFileAnnotation endpoint. Attackers can inject malicious markup into annotation fields that execute as script in the PDF renderer with full Node.js access when a user opens an annotated PDF...

PT-2026-71758

The Elastic Cloud on Kubernetes ECK operator reads a list of secret references from an annotation on secrets it manages, and it accepts the namespace recorded in each reference without validating that the reference is authorized for the resource being reconciled. A user whose Kubernetes permissio...

CVE-2026-72526

Summary: CVE-2026-72526 concerns the multicloud-integrations component where the Application propagation controller mishandles the ocm-managed-cluster annotation from an Application CR without sufficient validation. This allows a hub-cluster tenant with permission to create Applications to target...

CVE-2026-72526 Multicloud-integrations: multicloud-integrations: pull-model propagation allows hub tenant to target arbitrary spoke cluster via unvalidated ocm-managed-cluster annotation

A flaw was found in the multicloud-integrations component. The Application propagation controller processes the ocm-managed-cluster annotation from an Application Custom Resource CR without proper validation. A tenant with permissions to create Applications on the hub cluster can exploit this to...

CVE-2026-72526 Multicloud-integrations: multicloud-integrations: pull-model propagation allows hub tenant to target arbitrary spoke cluster via unvalidated ocm-managed-cluster annotation

A flaw was found in the multicloud-integrations component. The Application propagation controller processes the ocm-managed-cluster annotation from an Application Custom Resource CR without proper validation. A tenant with permissions to create Applications on the hub cluster can exploit this to...

PT-2026-70970

Name of the Vulnerable Software and Affected Versions multicloud-integrations affected versions not specified Description A flaw exists in the multicloud-integrations component where the Application propagation controller fails to properly validate the ocm-managed-cluster annotation within an...

CVE-2026-13434

CVE-2026-13434 affects KubeVirt’s network annotation generator used when provisioning VirtualMachineInstance with Multus networks. The flaw writes the supplied networkName verbatim into the v1.multus-cni.io/default-network annotation without format validation or sanitization, with only an empty-s...

Kata Containers have VM Escape via virtiofsd Argument Injection through Default-Enabled Pod Annotations

Summary Kata Containers ships with a default configuration that allows pod creators to inject arbitrary command-line arguments into the virtiofsd process through the io.katacontainers.config.hypervisor.virtiofsextraargs pod annotation. By injecting -o source=/ along with --no-announce-submounts a...

BIT-NGINX-INGRESS-CONTROLLER-2026-4342 ingress-nginx comment-based nginx configuration injection

A security issue was discovered in ingress-nginx where a combination of Ingress annotations can be used to inject configuration into nginx. This can lead to arbitrary code execution in the context of the ingress-nginx controller, and disclosure of Secrets accessible to the controller. Note that i...

Exploit for CVE-2026-4342

CVE-2026-4342 Test Environment Configuration These files set...

GHSA-F53H-MXV9-CP98 ingress-nginx comment-based nginx configuration injection

A security issue was discovered in ingress-nginx where a combination of Ingress annotations can be used to inject configuration into nginx. This can lead to arbitrary code execution in the context of the ingress-nginx controller, and disclosure of Secrets accessible to the controller. Note that i...

CVE-2026-4342

A security issue was discovered in ingress-nginx where a combination of Ingress annotations can be used to inject configuration into nginx. This can lead to arbitrary code execution in the context of the ingress-nginx controller, and disclosure of Secrets accessible to the controller. Note that i...

CVE-2026-4342

The CVE-2026-4342 entry concerns ingress-nginx. A combination of Ingress annotations can inject configuration into nginx, enabling arbitrary code execution in the ingress-nginx controller and disclosure of Secrets accessible to the controller. Note that, in default installations, the controller c...

CVE-2026-4342

A security issue was discovered in ingress-nginx where a combination of Ingress annotations can be used to inject configuration into nginx. This can lead to arbitrary code execution in the context of the ingress-nginx controller, and disclosure of Secrets accessible to the controller. Note that i...