{"schema_version":1,"title":"k8s.io/ingress-nginx (Go) vulnerabilities","summary":"Junglewise Threat Intelligence has tracked 17 vulnerabilities in k8s.io/ingress-nginx (Go): 0 in the last 7 days and 0 in the last 90 days, 0 of them critical and 0 exploited in the wild. The most recent, CVE-2026-4342, was published on 19 March 2026.","url":"https://junglewise.ai/threats/technologies/k8s-io-ingress-nginx","json_url":"https://junglewise.ai/threats/technologies/k8s-io-ingress-nginx.json","publisher":"Junglewise Threat Intelligence","license":"CC-BY-4.0","license_url":"https://creativecommons.org/licenses/by/4.0/","attribution":"Junglewise Threat Intelligence, https://junglewise.ai/threats/technologies/k8s-io-ingress-nginx","sources":"NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories","kind":"technology","counts":{"high":1,"all_time":17,"critical":0,"exploited":0,"last_7_days":0,"last_30_days":0,"last_90_days":0,"last_365_days":5},"latest":[{"cve":"CVE-2026-4342","cvss":8.8,"epss":0.006,"slug":"cve-2026-4342-kubernetes-ingress-nginx-configuration-injection-via-annotations","title":"Kubernetes ingress-nginx configuration injection via annotations","severity":"high","exploited":false,"published_at":"2026-03-19T22:16:43.143+00:00","url":"https://junglewise.ai/threats/cve-2026-4342-kubernetes-ingress-nginx-configuration-injection-via-annotations"},{"cve":"CVE-2026-1580","cvss":3.1,"epss":0.005,"slug":"cve-2026-1580-ingress-nginx-s-nginx-ingress-kubernetes-io-auth-method-ingress","title":"GO-2026-4423 - ingress-nginx's `nginx.ingress.kubernetes.io/auth-method` Ingress annotation can be used to inject configuration into nginx in k8s.io/ingres","severity":"low","exploited":false,"published_at":"2026-02-05T03:20:48+00:00","url":"https://junglewise.ai/threats/cve-2026-1580-ingress-nginx-s-nginx-ingress-kubernetes-io-auth-method-ingress"},{"cve":"CVE-2026-24513","cvss":3.1,"epss":0.0032,"slug":"cve-2026-24513-ingress-nginx-has-improper-check-for-unusual-or-exceptional","title":"GO-2026-4419 - ingress-nginx has Improper Check for Unusual or Exceptional Conditions in k8s.io/ingress-nginx","severity":"low","exploited":false,"published_at":"2026-02-05T03:20:48+00:00","url":"https://junglewise.ai/threats/cve-2026-24513-ingress-nginx-has-improper-check-for-unusual-or-exceptional"},{"cve":"CVE-2026-24512","cvss":3.1,"epss":0.0052,"slug":"cve-2026-24512-ingress-nginx-s-rules-http-paths-path-ingress-field-can-be-used","title":"GO-2026-4426 - ingress-nginx's `rules.http.paths.path` Ingress field can be used to inject configuration into nginx in k8s.io/ingress-nginx","severity":"low","exploited":false,"published_at":"2026-02-05T03:20:48+00:00","url":"https://junglewise.ai/threats/cve-2026-24512-ingress-nginx-s-rules-http-paths-path-ingress-field-can-be-used"},{"cve":"CVE-2026-24514","cvss":3.1,"epss":0.0049,"slug":"cve-2026-24514-ingress-nginx-vulnerable-to-allocation-of-resources-without","title":"GO-2026-4417 - ingress-nginx vulnerable to Allocation of Resources Without Limits or Throttling in k8s.io/ingress-nginx","severity":"low","exploited":false,"published_at":"2026-02-05T03:20:45+00:00","url":"https://junglewise.ai/threats/cve-2026-24514-ingress-nginx-vulnerable-to-allocation-of-resources-without"},{"cve":"CVE-2025-1098","cvss":3.1,"epss":0.8231,"slug":"cve-2025-1098-ingress-nginx-controller-configuration-injection-via-unsanitized","title":"GO-2025-3568 - ingress-nginx controller - configuration injection via unsanitized mirror annotations in k8s.io/ingress-nginx","severity":"low","exploited":false,"published_at":"2025-03-25T19:38:11+00:00","url":"https://junglewise.ai/threats/cve-2025-1098-ingress-nginx-controller-configuration-injection-via-unsanitized"},{"cve":"CVE-2025-24513","cvss":3.1,"epss":0.0327,"slug":"cve-2025-24513-ingress-nginx-controller-auth-secret-file-path-traversal","title":"GO-2025-3564 - ingress-nginx controller - auth secret file path traversal vulnerability in k8s.io/ingress-nginx","severity":"low","exploited":false,"published_at":"2025-03-25T19:38:11+00:00","url":"https://junglewise.ai/threats/cve-2025-24513-ingress-nginx-controller-auth-secret-file-path-traversal"},{"cve":"CVE-2025-24514","cvss":3.1,"epss":0.3046,"slug":"cve-2025-24514-ingress-nginx-controller-configuration-injection-via-unsanitized","title":"GO-2025-3566 - ingress-nginx controller - configuration injection via unsanitized auth-url annotation in k8s.io/ingress-nginx","severity":"low","exploited":false,"published_at":"2025-03-25T19:38:11+00:00","url":"https://junglewise.ai/threats/cve-2025-24514-ingress-nginx-controller-configuration-injection-via-unsanitized"},{"cve":"CVE-2025-1974","cvss":3.1,"epss":0.9938,"slug":"cve-2025-1974-ingress-nginx-admission-controller-rce-escalation","title":"GO-2025-3567 - ingress-nginx admission controller RCE escalation in k8s.io/ingress-nginx","severity":"low","exploited":false,"published_at":"2025-03-25T19:38:11+00:00","url":"https://junglewise.ai/threats/cve-2025-1974-ingress-nginx-admission-controller-rce-escalation"},{"cve":"CVE-2025-1097","cvss":3.1,"epss":0.3324,"slug":"cve-2025-1097-ngress-nginx-controller-configuration-injection-via-unsanitized","title":"GO-2025-3565 - ngress-nginx controller - configuration injection via unsanitized auth-tls-match-cn annotation in k8s.io/ingress-nginx","severity":"low","exploited":false,"published_at":"2025-03-25T19:38:11+00:00","url":"https://junglewise.ai/threats/cve-2025-1097-ngress-nginx-controller-configuration-injection-via-unsanitized"},{"cve":"CVE-2023-5044","cvss":3.1,"epss":0.5661,"slug":"cve-2023-5044-ingress-nginx-code-injection-via-nginx-ingress-kubernetes-io","title":"GO-2024-2428 - Ingress-nginx code injection via nginx.ingress.kubernetes.io/permanent-redirect annotation in k8s.io/ingress-nginx","severity":"low","exploited":false,"published_at":"2024-06-28T15:28:53+00:00","url":"https://junglewise.ai/threats/cve-2023-5044-ingress-nginx-code-injection-via-nginx-ingress-kubernetes-io"},{"cve":"CVE-2023-5043","cvss":3.1,"epss":0.0223,"slug":"cve-2023-5043-ingress-nginx-annotation-injection-causes-arbitrary-command","title":"Ingress nginx annotation injection causes arbitrary command execution","severity":"low","exploited":false,"published_at":"2023-10-25T21:30:33+00:00","url":"https://junglewise.ai/threats/cve-2023-5043-ingress-nginx-annotation-injection-causes-arbitrary-command"},{"cve":"CVE-2022-4886","cvss":3.1,"epss":0.0155,"slug":"cve-2022-4886-ingress-nginx-path-sanitization-can-be-bypassed","title":"Ingress-nginx path sanitization can be bypassed","severity":"low","exploited":false,"published_at":"2023-10-25T21:30:32+00:00","url":"https://junglewise.ai/threats/cve-2022-4886-ingress-nginx-path-sanitization-can-be-bypassed"},{"cve":"CVE-2021-25748","cvss":3.1,"epss":0.0069,"slug":"cve-2021-25748-ingress-nginx-path-sanitization-can-be-bypassed-with-newline","title":"Ingress-nginx `path` sanitization can be bypassed with newline character","severity":"low","exploited":false,"published_at":"2023-05-24T18:30:26+00:00","url":"https://junglewise.ai/threats/cve-2021-25748-ingress-nginx-path-sanitization-can-be-bypassed-with-newline"},{"cve":"CVE-2020-8553","cvss":3.1,"epss":0.0089,"slug":"cve-2020-8553-ingress-nginx-component-for-kubernetes-allows-file-overwrite","title":"ingress-nginx component for Kubernetes allows file overwrite","severity":"low","exploited":false,"published_at":"2022-05-24T17:24:40+00:00","url":"https://junglewise.ai/threats/cve-2020-8553-ingress-nginx-component-for-kubernetes-allows-file-overwrite"},{"cve":"CVE-2018-1002104","cvss":3.1,"epss":0.0114,"slug":"cve-2018-1002104-kubernetes-ingress-exposes-sensitive-information","title":"Kubernetes ingress exposes sensitive information","severity":"low","exploited":false,"published_at":"2022-05-24T17:06:10+00:00","url":"https://junglewise.ai/threats/cve-2018-1002104-kubernetes-ingress-exposes-sensitive-information"},{"cve":"CVE-2021-25745","cvss":3.1,"epss":0.0118,"slug":"cve-2021-25745-improper-input-validation-in-k8s-io-ingress-nginx","title":"Improper Input Validation in k8s.io/ingress-nginx","severity":"low","exploited":false,"published_at":"2022-05-07T00:00:49+00:00","url":"https://junglewise.ai/threats/cve-2021-25745-improper-input-validation-in-k8s-io-ingress-nginx"}],"weekly":[{"week":"2026-07-06","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-13","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-20","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-27","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-03","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-10","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-17","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-24","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-31","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-07","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-14","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-21","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-28","critical":0,"exploited":0,"vulnerabilities":0}],"related":[{"name":"github.com/mattermost/mattermost-server (Go)","slug":"github-com-mattermost-mattermost-server","vulnerabilities":274,"url":"https://junglewise.ai/threats/technologies/github-com-mattermost-mattermost-server"},{"name":"github.com/mattermost/mattermost-server/v6 (Go)","slug":"github-com-mattermost-mattermost-server-v6","vulnerabilities":188,"url":"https://junglewise.ai/threats/technologies/github-com-mattermost-mattermost-server-v6"},{"name":"github.com/mattermost/mattermost-server/v5 (Go)","slug":"github-com-mattermost-mattermost-server-v5","vulnerabilities":186,"url":"https://junglewise.ai/threats/technologies/github-com-mattermost-mattermost-server-v5"},{"name":"github.com/mattermost/mattermost/server/v8 (Go)","slug":"github-com-mattermost-mattermost-server-v8","vulnerabilities":182,"url":"https://junglewise.ai/threats/technologies/github-com-mattermost-mattermost-server-v8"},{"name":"stdlib (Go)","slug":"go-stdlib","vulnerabilities":161,"url":"https://junglewise.ai/threats/technologies/go-stdlib"},{"name":"github.com/siyuan-note/siyuan/kernel (Go)","slug":"github-com-siyuan-note-siyuan-kernel","vulnerabilities":158,"url":"https://junglewise.ai/threats/technologies/github-com-siyuan-note-siyuan-kernel"},{"name":"code.gitea.io/gitea (Go)","slug":"code-gitea-io-gitea","vulnerabilities":128,"url":"https://junglewise.ai/threats/technologies/code-gitea-io-gitea"},{"name":"gogs.io/gogs (Go)","slug":"gogs-io-gogs","vulnerabilities":82,"url":"https://junglewise.ai/threats/technologies/gogs-io-gogs"},{"name":"github.com/traefik/traefik (Go)","slug":"github-com-traefik-traefik","vulnerabilities":75,"url":"https://junglewise.ai/threats/technologies/github-com-traefik-traefik"},{"name":"github.com/usememos/memos (Go)","slug":"github-com-usememos-memos","vulnerabilities":75,"url":"https://junglewise.ai/threats/technologies/github-com-usememos-memos"},{"name":"github.com/traefik/traefik/v2 (Go)","slug":"github-com-traefik-traefik-v2","vulnerabilities":73,"url":"https://junglewise.ai/threats/technologies/github-com-traefik-traefik-v2"},{"name":"github.com/traefik/traefik/v3 (Go)","slug":"github-com-traefik-traefik-v3","vulnerabilities":68,"url":"https://junglewise.ai/threats/technologies/github-com-traefik-traefik-v3"}],"technology":{"hub":true,"name":"k8s.io/ingress-nginx (Go)","slug":"k8s-io-ingress-nginx","vendor":{"name":"Go","slug":"go","url":"https://junglewise.ai/threats/vendors/go"},"aliases":[],"url":"https://junglewise.ai/threats/technologies/k8s-io-ingress-nginx"},"most_severe":[{"cve":"CVE-2026-4342","cvss":8.8,"epss":0.006,"slug":"cve-2026-4342-kubernetes-ingress-nginx-configuration-injection-via-annotations","title":"Kubernetes ingress-nginx configuration injection via annotations","severity":"high","exploited":false,"published_at":"2026-03-19T22:16:43.143+00:00","url":"https://junglewise.ai/threats/cve-2026-4342-kubernetes-ingress-nginx-configuration-injection-via-annotations"},{"cve":"CVE-2025-1974","cvss":3.1,"epss":0.9938,"slug":"cve-2025-1974-ingress-nginx-admission-controller-rce-escalation","title":"GO-2025-3567 - ingress-nginx admission controller RCE escalation in k8s.io/ingress-nginx","severity":"low","exploited":false,"published_at":"2025-03-25T19:38:11+00:00","url":"https://junglewise.ai/threats/cve-2025-1974-ingress-nginx-admission-controller-rce-escalation"},{"cve":"CVE-2025-1098","cvss":3.1,"epss":0.8231,"slug":"cve-2025-1098-ingress-nginx-controller-configuration-injection-via-unsanitized","title":"GO-2025-3568 - ingress-nginx controller - configuration injection via unsanitized mirror annotations in k8s.io/ingress-nginx","severity":"low","exploited":false,"published_at":"2025-03-25T19:38:11+00:00","url":"https://junglewise.ai/threats/cve-2025-1098-ingress-nginx-controller-configuration-injection-via-unsanitized"},{"cve":"CVE-2023-5044","cvss":3.1,"epss":0.5661,"slug":"cve-2023-5044-ingress-nginx-code-injection-via-nginx-ingress-kubernetes-io","title":"GO-2024-2428 - Ingress-nginx code injection via nginx.ingress.kubernetes.io/permanent-redirect annotation in k8s.io/ingress-nginx","severity":"low","exploited":false,"published_at":"2024-06-28T15:28:53+00:00","url":"https://junglewise.ai/threats/cve-2023-5044-ingress-nginx-code-injection-via-nginx-ingress-kubernetes-io"},{"cve":"CVE-2025-1097","cvss":3.1,"epss":0.3324,"slug":"cve-2025-1097-ngress-nginx-controller-configuration-injection-via-unsanitized","title":"GO-2025-3565 - ngress-nginx controller - configuration injection via unsanitized auth-tls-match-cn annotation in k8s.io/ingress-nginx","severity":"low","exploited":false,"published_at":"2025-03-25T19:38:11+00:00","url":"https://junglewise.ai/threats/cve-2025-1097-ngress-nginx-controller-configuration-injection-via-unsanitized"},{"cve":"CVE-2025-24514","cvss":3.1,"epss":0.3046,"slug":"cve-2025-24514-ingress-nginx-controller-configuration-injection-via-unsanitized","title":"GO-2025-3566 - ingress-nginx controller - configuration injection via unsanitized auth-url annotation in k8s.io/ingress-nginx","severity":"low","exploited":false,"published_at":"2025-03-25T19:38:11+00:00","url":"https://junglewise.ai/threats/cve-2025-24514-ingress-nginx-controller-configuration-injection-via-unsanitized"},{"cve":"CVE-2025-24513","cvss":3.1,"epss":0.0327,"slug":"cve-2025-24513-ingress-nginx-controller-auth-secret-file-path-traversal","title":"GO-2025-3564 - ingress-nginx controller - auth secret file path traversal vulnerability in k8s.io/ingress-nginx","severity":"low","exploited":false,"published_at":"2025-03-25T19:38:11+00:00","url":"https://junglewise.ai/threats/cve-2025-24513-ingress-nginx-controller-auth-secret-file-path-traversal"},{"cve":"CVE-2023-5043","cvss":3.1,"epss":0.0223,"slug":"cve-2023-5043-ingress-nginx-annotation-injection-causes-arbitrary-command","title":"Ingress nginx annotation injection causes arbitrary command execution","severity":"low","exploited":false,"published_at":"2023-10-25T21:30:33+00:00","url":"https://junglewise.ai/threats/cve-2023-5043-ingress-nginx-annotation-injection-causes-arbitrary-command"},{"cve":"CVE-2022-4886","cvss":3.1,"epss":0.0155,"slug":"cve-2022-4886-ingress-nginx-path-sanitization-can-be-bypassed","title":"Ingress-nginx path sanitization can be bypassed","severity":"low","exploited":false,"published_at":"2023-10-25T21:30:32+00:00","url":"https://junglewise.ai/threats/cve-2022-4886-ingress-nginx-path-sanitization-can-be-bypassed"},{"cve":"CVE-2021-25745","cvss":3.1,"epss":0.0118,"slug":"cve-2021-25745-improper-input-validation-in-k8s-io-ingress-nginx","title":"Improper Input Validation in k8s.io/ingress-nginx","severity":"low","exploited":false,"published_at":"2022-05-07T00:00:49+00:00","url":"https://junglewise.ai/threats/cve-2021-25745-improper-input-validation-in-k8s-io-ingress-nginx"}],"generated_at":"2026-09-28T03:07:00.154823+00:00"}