Critical Security Flaws Discovered in Ingress NGINX as End-of-Life Looms

Kubernetes administrators are facing a critical juncture: four newly identified security vulnerabilities have surfaced in Ingress NGINX, a widely used traffic controller for Kubernetes deployments. These flaws, ranging in severity, demand immediate attention, particularly as official support for Ingress NGINX is set to expire in March, leaving systems unpatched and exposed.

The most pressing concerns stem from two vulnerabilities carrying a CVSS score of 8.8, indicating high severity. These issues highlight the inherent risks of relying on software nearing its end-of-life and underscore the urgent need for migration to more actively maintained alternatives.

Understanding the Vulnerabilities

CVE-2026-1580 centers around improper input validation. If an Ingress NGINX controller is configured with custom error handling for HTTP 401 or 403 errors, and that custom backend fails to correctly interpret the X-Code HTTP header, an attacker could bypass authentication and access restricted resources. This essentially creates an open door to sensitive areas of the application.

Even more alarming is CVE-2026-24512, a configuration injection vulnerability. This flaw allows malicious actors to inject configurations into the NGINX instance via the rules.http.paths.path Ingress field. Successful exploitation could lead to arbitrary code execution within the controller’s context, potentially exposing critical secrets and granting unauthorized access to the entire Kubernetes cluster.

“The potential impact of CVE-2026-24512 is significant,” explains Kellman Meghu, CTO of DeepCove Cybersecurity. “An attacker could essentially create a direct pathway to internal resources that should remain inaccessible. This isn’t just about service disruption; it’s a foundational breach that could escalate into a full-scale compromise.”

Ingress NGINX functions as a reverse proxy and load balancer, acting as the initial point of contact for web traffic entering a Kubernetes infrastructure. Its ability to dynamically reload configurations makes it highly adaptable to changing cluster conditions, but also introduces a potential attack surface if not properly secured.

The vulnerabilities specifically affect Ingress NGINX versions 1.13.7 and below, as well as 1.14.3 and below. Administrators utilizing these versions within their Kubernetes clusters are strongly advised to upgrade immediately.

The Impending End-of-Life and Migration Strategies

The urgency surrounding these vulnerabilities is amplified by the upcoming end-of-life for Ingress NGINX, announced at KubeCon in November. As of March, the project will no longer receive security patches or bug fixes, leaving systems vulnerable to exploitation. This situation has prompted experts to advocate for a swift transition to alternative traffic controllers.

The Kubernetes Gateway API is widely recommended as the new standard for traffic management, offering a vendor-neutral and robust solution. Other viable options include Cilium Ingress, Traefik, and HAProxy Ingress.

Beyond the high-severity vulnerabilities, CVE-2026-24513, while considered lower risk, could be exploited if an attacker can manipulate specific error configurations. CVE-2026-24514 presents a medium-level risk, potentially allowing attackers to overwhelm the controller with requests, leading to a denial-of-service condition.

These recent discoveries build upon past security concerns. Just over a year ago, researchers uncovered “IngressNightmare,” a collection of critical remote code execution (RCE) flaws that could allow unauthenticated users to inject malicious configurations and gain control of the entire Kubernetes cluster.

Satnam Narang, senior staff research engineer at Tenable, notes that while the new vulnerabilities are less severe than IngressNightmare, they serve as a crucial reminder of the risks associated with outdated software. “Migration is no longer a suggestion; it’s a necessity,” he emphasizes. “Given the impending retirement of Ingress NGINX, proactive migration is the most effective strategy to mitigate these vulnerabilities.”

What challenges are you anticipating in migrating away from Ingress NGINX? And how are you prioritizing security updates within your Kubernetes infrastructure?

Stay informed about the latest security threats and best practices for Kubernetes deployments. Protecting your infrastructure requires constant vigilance and proactive measures.

Share this article with your colleagues and join the discussion in the comments below. Let’s work together to build a more secure Kubernetes ecosystem.