# CVE-2026-4342: Kubernetes ingress-nginx configuration injection via annotations

Source: https://junglewise.ai/threats/cve-2026-4342-kubernetes-ingress-nginx-configuration-injection-via-annotations  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-03-19. Updated: 2026-05-19  
License: CC BY 4.0 with a link back

CVE-2026-4342 · Severity: high · CVSS 8.8 · Published 2026-03-19

A vulnerability was found in the Kubernetes ingress-nginx controller, which manages external access to services in a cluster. An attacker with permission to create or modify Ingress objects can inject malicious configuration settings. This could allow them to execute unauthorized code or steal sensitive information, such as passwords and API keys, from across the entire cluster.

Technologies: [k8s.io/ingress-nginx (Go)](https://junglewise.ai/threats/technologies/k8s-io-ingress-nginx). Vendors: [Go](https://junglewise.ai/threats/vendors/go), [Kubernetes](https://junglewise.ai/threats/vendors/kubernetes).

## Quick answers

**Is CVE-2026-4342 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-4342 being exploited in the wild.

**How severe is CVE-2026-4342?** High severity, with a CVSS score of 8.8, published 19 March 2026.

**Which products and versions are affected?** k8s.io/ingress-nginx (Go) SEMVER:introduced=0,fixed=0.0.0-20260319175635-5183b7d86137; Kubernetes Ingress-Nginx < 1.13.9, 1.14.0 to < 1.14.5, 1.15.0.

**Is there a fix for CVE-2026-4342?** Yes. k8s.io/ingress-nginx (Go): upgrade to 0.0.0-20260319175635-5183b7d86137 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-4342 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-4342?** Check whether you run k8s.io/ingress-nginx (Go) or Kubernetes Ingress-Nginx at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- k8s.io/ingress-nginx (Go): upgrade to 0.0.0-20260319175635-5183b7d86137 or later

  ```sh
  go get k8s.io/ingress-nginx@v0.0.0-20260319175635-5183b7d86137
  ```


## Technical details

A configuration injection vulnerability exists in ingress-nginx due to improper validation of Ingress annotations. An attacker with low-privileged 'create' or 'patch' permissions on Ingress resources can use specific annotation combinations to inject arbitrary directives into the generated nginx configuration. This can be leveraged to achieve arbitrary code execution within the context of the ingress-nginx controller pod. Because the controller often runs with broad permissions, an attacker may also be able to retrieve all Kubernetes Secrets accessible to the controller, which in default installations includes cluster-wide access. The issue is addressed in versions 1.13.9, 1.14.5, and 1.15.1.

## Affected products

- Kubernetes ingress-nginx < 1.13.9, 1.14.0 to < 1.14.5, 1.15.0

## Identifiers

- CVE-2026-4342
- GHSA-f53h-mxv9-cp98
- GO-2026-4796

## Timeline

- 2026-03-19: disclosed
- 2026-03-19: advisory
- 2026-03-19: patched

## References

- [https://github.com/kubernetes/kubernetes/issues/137893](https://github.com/kubernetes/kubernetes/issues/137893)
- [http://www.openwall.com/lists/oss-security/2026/03/19/9](http://www.openwall.com/lists/oss-security/2026/03/19/9)

## Related threats

- [ingress-nginx's `rules.http.paths.path` Ingress field can be used to inject configuration into nginx](https://junglewise.ai/threats/cve-2026-24512-ingress-nginx-s-rules-http-paths-path-ingress-field-can-be-used)
- [ingress-nginx's `nginx.ingress.kubernetes.io/auth-method` Ingress annotation can be used to inject configuration into nginx](https://junglewise.ai/threats/cve-2026-1580-ingress-nginx-s-nginx-ingress-kubernetes-io-auth-method-ingress)
- [GO-2026-4419 - ingress-nginx has Improper Check for Unusual or Exceptional Conditions in k8s.io/ingress-nginx](https://junglewise.ai/threats/cve-2026-24513-ingress-nginx-has-improper-check-for-unusual-or-exceptional)
- [GO-2026-4417 - ingress-nginx vulnerable to Allocation of Resources Without Limits or Throttling in k8s.io/ingress-nginx](https://junglewise.ai/threats/cve-2026-24514-ingress-nginx-vulnerable-to-allocation-of-resources-without)
- [GO-2025-3567 - ingress-nginx admission controller RCE escalation in k8s.io/ingress-nginx](https://junglewise.ai/threats/cve-2025-1974-ingress-nginx-admission-controller-rce-escalation)