46 matches found
CVE-2026-3288-lab
CVE-2026-3288 脆弱性ラボ（Docker） NGINX Ingress Controller 設定インジェクション ⚠️ 警告 : このラボには意図的に脆弱な設定が含まれており、認可されたセキュリティトレーニング専用 です。 脆弱性の概要 CVE-2026-3288 （CVSS 8.8 HIGH）- NGINX Ingress Controller における設定インジェクション 影響を受けるバージョン : v1.13.8、v1.14.4、v1.15.0 攻撃ベクトル : パス設定における二重引用符（"）インジェクション 影響 :...
CVE-2026-77180
When NGINX Ingress Controller is configured with Ingress annotations, an injection vulnerability exists in the configuration generator of NGINX Ingress Controller. Multiple user-controllable fields are written into the generated NGINX configuration without sanitization. An authenticated attacker...
CVE-2026-77180
NGINX Ingress Controller is vulnerable to a configuration injection flaw (CWE-76) in its configuration generator. Multiple user-controllable Ingress annotation fields are written into the generated NGINX configuration without sanitization , allowing an authenticated attacker with Kubernetes API w...
EUVD-2026-70141
When NGINX Ingress Controller is configured with Ingress annotations, an injection vulnerability exists in the configuration generator of NGINX Ingress Controller. Multiple user-controllable fields are written into the generated NGINX configuration without sanitization. An authenticated attacker...
CVE-2026-77180 NGINX Ingress Controller vulnerability
When NGINX Ingress Controller is configured with Ingress annotations, an injection vulnerability exists in the configuration generator of NGINX Ingress Controller. Multiple user-controllable fields are written into the generated NGINX configuration without sanitization. An authenticated attacker...
K000162601: NGINX Ingress Controller vulnerability CVE-2026-77180
Security Advisory Description When NGINX Ingress Controller is configured with Ingress annotations, an injection vulnerability exists in the configuration generator of NGINX Ingress Controller. Multiple user-controllable fields are written into the generated NGINX configuration without...
CVE-2023-5044
CVE-2023-5044 CVE 2023 5044에 대한 PoC 전제 조건 Kind: v0.20.0 Kubectl: v1.29.3 Docker: v26.0.0 PoC Docker에 올바른 권한을 부여합니다 root@kitploit: sudo usermod -aG docker $USER && newgrp docker extraPortMaping 및 node-labels를 사용하여 클러스터를 시작하여 인그레스를 준비합니다. root@kitploit: cat EOF | kind create cluster --config=- kind...
CVE-2024-7646
CVE-2024-7646 PoC CVE-2024-7646 root@kitploit: apiVersion: networking.k8s.io/v1 kind: Ingress metadata: name: example-ingress annotations: nginx.ingress.kubernetes.io/server-snippet: | addheader X-Pwn-Header "Pwn\r\n HTTP/1.1 200 OK Content-Type: text/html alert'XSS'; --------"; return 200 "PWNed...
CVE-2023-5044
CVE-2023-5044 nginx.ingress.kubernetes.io/permanent-redirect 어노테이션을 통한 코드 인젝션 먼저, Pod와 Service를 배포해야 합니다: root@kitploit: kind: Pod apiVersion: v1 metadata: name: apple-app labels: app: apple spec: containers: - name: apple-app image: hashicorp/http-echo args: - "-text=apple" --- kind: Service...
CVE-2026-52865
When NGINX Ingress Controller processes Ingress or TransportServer resources, an authenticated, remote attacker with permission to create or modify Ingress or TransportServer resources can cause the NGINX Ingress Controller process to terminate. Impact: The NGINX Ingress Controller control plane...
CVE-2026-52865 NGINX Ingress Controller vulnerability
When NGINX Ingress Controller processes Ingress or TransportServer resources, an authenticated, remote attacker with permission to create or modify Ingress or TransportServer resources can cause the NGINX Ingress Controller process to terminate. Impact: The NGINX Ingress Controller control plane...
CVE-2026-52865
CVE-2026-52865 affects the NGINX Ingress Controller. When processing Ingress or TransportServer resources, an authenticated remote attacker with write access to create/modify those resources can cause the NGINX Ingress Controller process to terminate, leading to a persistent crash loop in the con...
EUVD-2026-44680
When NGINX Ingress Controller is configured with Custom Resource Definitions CRDs or Ingress annotations, an injection vulnerability exists in the configuration generator of NGINX Ingress Controller. Multiple user-controllable fields are written into the generated NGINX configuration without...
K000161837: Out-of-band Security Notification (July 15, 2026)
Security Advisory Description On July 15, 2026, F5 announced the following security issues. This document is intended to serve as an overview of these vulnerabilities to help determine the impact to your F5 devices. You can find the details of each issue in the associated articles. Article CVE|...
K000161834: NGINX Ingress Controller vulnerability CVE-2026-52865
Security Advisory Description When NGINX Ingress Controller processes Ingress or TransportServer resources, an authenticated, remote attacker with permission to create or modify Ingress or TransportServer resources can cause the NGINX Ingress Controller process to terminate. CVE-2026-52865 Impact...
K000161800: NGINX Ingress Controller vulnerability CVE-2026-55723
Security Advisory Description When NGINX Ingress Controller is configured with Custom Resource Definitions CRDs or Ingress annotations, an injection vulnerability exists in the configuration generator of NGINX Ingress Controller. Multiple user-controllable fields are written into the generated...
PT-2026-60183
Name of the Vulnerable Software and Affected Versions NGINX Ingress Controller affected versions not specified Description An injection flaw exists in the configuration generator when the software is configured with Custom Resource Definitions CRDs or Ingress annotations. Multiple user-controllab...
EUVD-2025-203903
A vulnerability exists in NGINX Ingress Controller's nginx.org/rewrite-target annotation validation. Note: Software versions which have reached End of Technical Support EoTS are not evaluated...
