EUVD-2026-51815

Traefik: Kubernetes Ingress NGINX RewriteTarget Path Traversal Allows Route-Level Authentication Bypass...

Ingress-Nginx Controller - Configuration Injection via Unsanitized `auth-tls-match-cn` Annotation

A security issue was discovered in ingress-nginx https-//github.com/kubernetes/ingress-nginx where the auth-tls-match-cn Ingress annotation can be used to inject configuration into nginx. This can lead to arbitrary code execution in the context of the ingress-nginx controller, and disclosure of...

Ingress-Nginx Controller - Configuration Injection via Unsanitized `auth-url` Annotation

A security issue was discovered in ingress-nginx https-//github.com/kubernetes/ingress-nginx where the auth-url Ingress annotation can be used to inject configuration into nginx. This can lead to arbitrary code execution in the context of the ingress-nginx controller, and disclosure of Secrets...

EUVD-2026-47646

Traefik CRD IngressRouteTCP ServersTransport Cross-Provider Namespace Bypass...

Ingress-Nginx Controller - Remote Code Execution

A security issue was discovered in Kubernetes where under certain conditions, an unauthenticated attacker with access to the pod network can achieve arbitrary code execution in the context of the ingress-nginx controller. This can lead to disclosure of Secrets accessible to the controller. Note...

GHSA-7QF5-7PPR-87V8 Duplicate Advisory: Kubernetes Ingress NGINX RewriteTarget Path Traversal Allows Route-Level Authentication Bypass

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-8rxv-jg7p-wvg3. This link is maintained to preserve external references. Original Description Traefik versions = v3.7.0 and = v3.7.7 contain a path traversal vulnerability in the Kubernetes Ingress NGINX...

CVE-2026-67309

Traefik versions = v3.7.0 and = v3.7.7 contain a path traversal vulnerability in the Kubernetes Ingress NGINX provider's RewriteTarget middleware generated from the nginx.ingress.kubernetes.io/rewrite-target annotation. When an Ingress path uses a regex that captures attacker-controlled text...

CVE-2026-67309

Traefik 3.7.x (>=3.7.0 and

CVE-2026-67309 Traefik v3.7.0 Path Traversal via RewriteTarget Authentication Bypass

Traefik versions = v3.7.0 and = v3.7.7 contain a path traversal vulnerability in the Kubernetes Ingress NGINX provider's RewriteTarget middleware generated from the nginx.ingress.kubernetes.io/rewrite-target annotation. When an Ingress path uses a regex that captures attacker-controlled text...

CVE-2026-67309

Traefik versions = v3.7.0 and = v3.7.7 contain a path traversal vulnerability in the Kubernetes Ingress NGINX provider's RewriteTarget middleware generated from the nginx.ingress.kubernetes.io/rewrite-target annotation. When an Ingress path uses a regex that captures attacker-controlled text...

CVE-2026-67309 Traefik v3.7.0 Path Traversal via RewriteTarget Authentication Bypass

Traefik versions = v3.7.0 and = v3.7.7 contain a path traversal vulnerability in the Kubernetes Ingress NGINX provider's RewriteTarget middleware generated from the nginx.ingress.kubernetes.io/rewrite-target annotation. When an Ingress path uses a regex that captures attacker-controlled text...

CLEANSTART-2026-KL00437 Security fixes in ingress-nginx-controller-1.12 1.12.8-r0

Package ingress-nginx-controller-1.12 version 1.12.8-r0 fixes 4 vulnerabilities: CVE-2026-46600, CVE-2026-56852, CVE-2024-55549, CVE-2025-24855...

CLEANSTART-2026-CW84723 Security fixes in ingress-nginx-controller-1.14 1.14.5-r3

Package ingress-nginx-controller-1.14 version 1.14.5-r3 fixes 4 vulnerabilities: CVE-2026-46600, CVE-2026-56852, CVE-2024-55549, CVE-2025-24855...

CLEANSTART-2026-OQ29725 Security fixes in haproxy-ingress 0.15.4-r3

Package haproxy-ingress version 0.15.4-r3 fixes 1 vulnerabilities: CVE-2026-42504...

CLEANSTART-2026-GZ85503 Security fixes in haproxy-ingress 0.16.1-r3

Package haproxy-ingress version 0.16.1-r3 fixes 2 vulnerabilities: CVE-2026-39822, CVE-2026-42505...

CLEANSTART-2026-WO51629 Security fixes in ingress-nginx-controller-1.12 1.14.5-r1

Package ingress-nginx-controller-1.12 version 1.14.5-r1 fixes 10 vulnerabilities: CVE-2026-27145, CVE-2026-42504, CVE-2026-42507, CVE-2026-39824, CVE-2026-25681...

CLEANSTART-2026-QV63914 Security fixes in ingress-nginx-controller 1.24.2-r0

Package ingress-nginx-controller version 1.24.2-r0 fixes 9 vulnerabilities: CVE-2025-22871, CVE-2025-4673, CVE-2024-45341, CVE-2024-45336, CVE-2025-0913...

CLEANSTART-2026-TQ49781 Security fixes in ingress-nginx-controller-1.15 1.15.1-r2

Package ingress-nginx-controller-1.15 version 1.15.1-r2 fixes 3 vulnerabilities: CVE-2026-42504, CVE-2026-27145, CVE-2026-42507...

CLEANSTART-2026-AW13748 Security fixes in ingress-nginx-controller-1.15 1.15.1-r3

Package ingress-nginx-controller-1.15 version 1.15.1-r3 fixes 4 vulnerabilities: CVE-2026-46600, CVE-2026-56852, CVE-2026-39822, CVE-2026-42505...

CVE-2026-56852 affecting package application-gateway-kubernetes-ingress for versions less than 1.7.7-6

CVE-2026-56852 affecting package application-gateway-kubernetes-ingress for versions less than 1.7.7-6. A patched version of the package is available...