Is CVE-2026-4342 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-4342 being exploited in the wild.

How severe is CVE-2026-4342?

High severity, with a CVSS score of 8.8, published 19 March 2026.

Which products and versions are affected?

k8s.io/ingress-nginx (Go) SEMVER:introduced=0,fixed=0.0.0-20260319175635-5183b7d86137; Kubernetes Ingress-Nginx < 1.13.9, 1.14.0 to < 1.14.5, 1.15.0.

Is there a fix for CVE-2026-4342?

Yes. k8s.io/ingress-nginx (Go): upgrade to 0.0.0-20260319175635-5183b7d86137 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-4342 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-4342?

Check whether you run k8s.io/ingress-nginx (Go) or Kubernetes Ingress-Nginx at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-4342: Kubernetes ingress-nginx configuration injection via annotations

Q: Is there a fix for CVE-2026-4342?

Yes. k8s.io/ingress-nginx (Go): upgrade to 0.0.0-20260319175635-5183b7d86137 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-4342 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-4342?

Check whether you run k8s.io/ingress-nginx (Go) or Kubernetes Ingress-Nginx at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-4342 · Severity: high · CVSS 8.8 · Published 2026-03-19

A vulnerability was found in the Kubernetes ingress-nginx controller, which manages external access to services in a cluster. An attacker with permission to create or modify Ingress objects can inject malicious configuration settings. This could allow them to execute unauthorized code or steal sensitive information, such as passwords and API keys, from across the entire cluster.

Technologies: k8s.io/ingress-nginx (Go). Vendors: Go, Kubernetes.

Quick answers

Is CVE-2026-4342 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-4342 being exploited in the wild.
How severe is CVE-2026-4342?: High severity, with a CVSS score of 8.8, published 19 March 2026.
Which products and versions are affected?: k8s.io/ingress-nginx (Go) SEMVER:introduced=0,fixed=0.0.0-20260319175635-5183b7d86137; Kubernetes Ingress-Nginx < 1.13.9, 1.14.0 to < 1.14.5, 1.15.0.
Is there a fix for CVE-2026-4342?: Yes. k8s.io/ingress-nginx (Go): upgrade to 0.0.0-20260319175635-5183b7d86137 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-4342 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-4342?: Check whether you run k8s.io/ingress-nginx (Go) or Kubernetes Ingress-Nginx at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

k8s.io/ingress-nginx (Go): upgrade to 0.0.0-20260319175635-5183b7d86137 or later
```
go get k8s.io/ingress-nginx@v0.0.0-20260319175635-5183b7d86137
```

Technical details

A configuration injection vulnerability exists in ingress-nginx due to improper validation of Ingress annotations. An attacker with low-privileged 'create' or 'patch' permissions on Ingress resources can use specific annotation combinations to inject arbitrary directives into the generated nginx configuration. This can be leveraged to achieve arbitrary code execution within the context of the ingress-nginx controller pod. Because the controller often runs with broad permissions, an attacker may also be able to retrieve all Kubernetes Secrets accessible to the controller, which in default installations includes cluster-wide access. The issue is addressed in versions 1.13.9, 1.14.5, and 1.15.1.

Affected products

Kubernetes ingress-nginx < 1.13.9, 1.14.0 to < 1.14.5, 1.15.0

Identifiers

CVE-2026-4342
GHSA-f53h-mxv9-cp98
GO-2026-4796

Timeline

2026-03-19: disclosed
2026-03-19: advisory
2026-03-19: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.