CVE-2023-5044

CVE-2023-5044 Poc for CVE 2023 5044 Prerequisites Kind: v0.20.0 Kubectl: v1.29.3 Docker: v26.0.0 PoC Give Docker the correct privileges sudo usermod -aG docker $USER && newgrp docker Start the cluster with extraPortMaping and node-labels to prepare it for an ingress. cat EOF | kind create cluster...

CVE-2023-5044

CVE-2023-5044 Inyección de código mediante nginx.ingress.kubernetes.io/permanent-redirect annotation Primero, necesitas desplegar un Pod y un Service: kind: Pod apiVersion: v1 metadata: name: apple-app labels: app: apple spec: containers: - name: apple-app image: hashicorp/http-echo args: -...

CVE-2026-3288-lab

CVE-2026-3288 Vulnerable Lab Docker NGINX Ingress Controller Configuration Injection ⚠️ WARNING : This lab contains intentionally vulnerable configurations for AUTHORIZED SECURITY TRAINING ONLY Vulnerability Overview CVE-2026-3288 CVSS 8.8 HIGH - Configuration injection in NGINX Ingress Controller...

CVE-2024-7646

CVE-2024-7646 PoC CVE-2024-7646 apiVersion: networking.k8s.io/v1 kind: Ingress metadata: name: example-ingress annotations: nginx.ingress.kubernetes.io/server-snippet: | addheader X-Pwn-Header "Pwn\r\n HTTP/1.1 200 OK Content-Type: text/html alert'XSS'; --------"; return 200 "PWNed"; spec: rules:...

Nginx Out-of-band Security Notification (July 15, 2026)

NGINX Security Advisory: NGINX Ingress Controller vulnerability CVE-2026-55723 NGINX Ingress Controller NGINX Ingress Controller vulnerability CVE-2026-52865 NGINX Ingress Controller NGINX Agent vulnerability CVE-2026-60062 NGINX Agent, NGINX Instance Manager NGINX map directive and regex matchin...

CVE-2026-77180

When NGINX Ingress Controller is configured with Ingress annotations, an injection vulnerability exists in the configuration generator of NGINX Ingress Controller. Multiple user-controllable fields are written into the generated NGINX configuration without sanitization. An authenticated attacker...

EUVD-2026-70141

When NGINX Ingress Controller is configured with Ingress annotations, an injection vulnerability exists in the configuration generator of NGINX Ingress Controller. Multiple user-controllable fields are written into the generated NGINX configuration without sanitization. An authenticated attacker...

CVE-2026-77180

NGINX Ingress Controller is vulnerable to a configuration injection flaw (CWE-76) in its configuration generator. Multiple user-controllable Ingress annotation fields are written into the generated NGINX configuration without sanitization , allowing an authenticated attacker with Kubernetes API w...

CVE-2026-77180 NGINX Ingress Controller vulnerability

When NGINX Ingress Controller is configured with Ingress annotations, an injection vulnerability exists in the configuration generator of NGINX Ingress Controller. Multiple user-controllable fields are written into the generated NGINX configuration without sanitization. An authenticated attacker...

CVE-2026-77180 NGINX Ingress Controller vulnerability

When NGINX Ingress Controller is configured with Ingress annotations, an injection vulnerability exists in the configuration generator of NGINX Ingress Controller. Multiple user-controllable fields are written into the generated NGINX configuration without sanitization. An authenticated attacker...

K000162601: NGINX Ingress Controller vulnerability CVE-2026-77180

Security Advisory Description When NGINX Ingress Controller is configured with Ingress annotations, an injection vulnerability exists in the configuration generator of NGINX Ingress Controller. Multiple user-controllable fields are written into the generated NGINX configuration without...

CVE-2026-77180: Improper Neutralization of Equivalent Special Elements

When NGINX Ingress Controller is configured with Ingress annotations, an injection vulnerability exists in the configuration generator of NGINX Ingress Controller. Multiple user-controllable fields are written into the generated NGINX configuration without sanitization. An authenticated attacker...

PT-2026-84762

When NGINX Ingress Controller is configured with Ingress annotations, an injection vulnerability exists in the configuration generator of NGINX Ingress Controller. Multiple user-controllable fields are written into the generated NGINX configuration without sanitization. An authenticated attacker...

GO-2026-6094 vulnerabilities

Vulnerabilities for packages: openfga, cilium, cloud-provider-azure, k3s, kubernetes-csi-external-snapshotter, caddy, azure-service-operator, cluster-api-provider-vsphere, cloud-provider-gcp-cloud-controller-manager, cluster-api-gcp-controller, opentelemetry-operator, datadog-agent, descheduler,...

CVE-2026-50149

Contour is a Kubernetes ingress controller using Envoy proxy. In versions 1.23.0 through 1.33.4, when an HTTPProxy is configured with incompatible combination of both .spec.virtualhost.tls.enableFallbackCertificate: true and .spec.virtualhost.jwtProviders, Contour does not reject the configuratio...

CVE-2026-50149: Improper Certificate Validation

Contour is a Kubernetes ingress controller using Envoy proxy. In versions 1.23.0 through 1.33.4, when an HTTPProxy is configured with incompatible combination of both .spec.virtualhost.tls.enableFallbackCertificate: true and .spec.virtualhost.jwtProviders, Contour does not reject the configuratio...

GO-2024-2611 vulnerabilities

Vulnerabilities for packages: skopeo, prometheus-redis-exporter-fips, kubernetes-csi-livenessprobe, nri-discovery-kubernetes, request-1279, rekor, prometheus-stackdriver-exporter, crossplane-provider-aws-cloudformation, cert-exporter, crossplane-provider-aws, kubernetes-csi-external-provisioner,...

GO-2024-2428 vulnerabilities

Vulnerabilities for packages: ingress-nginx-controller...

GO-2026-5039 vulnerabilities

Vulnerabilities for packages: lazydocker, argo-rollouts, k3s, go, jitsucom-bulker, newrelic-infra-operator, temporal, sftpgo-plugin-auth, octo-sts, continuity, rancher-fleet, timoni, tofu-controller, mattermost, crossplane-provider-azure-storage, azcopy, aws-efs-csi-driver, addon-resizer,...

The vulnerabilities of the Ingress components and Custom Resource Definitions (CRDs) of the NGINX Ingress Controller platform allow a malicious actor to insert arbitrary configuration directives into NGINX, gain unauthorized access to file creation and deletion operations, or trigger service failures.

The vulnerability of the Ingress components and Custom Resource Definitions CRDs of the NGINX Ingress Controller monitoring and management platform is related to the lack of measures taken to neutralize special elements during the processing of string values. Exploiting this vulnerability allows ...