CVE-2026-116472

Received Received - Intake

Denial of Service in ingress-nginx via Ingress Annotation

Publication date: 2026-11-05

Last updated on: 2026-11-05

Assigner: Kubernetes

Description

A security issue was discovered in ingress-nginx where a user with permission to create an Ingress may be able to cause denial of service of the ingress-nginx data plane, or possibly redirect traffic from other Ingresses. Kubernetes clusters are only affected if they are using ingress-nginx. Due to a missing check, the mirror-target Ingress annotation can be used to target an unauthenticated configuration API within the ingress-nginx controller, allowing write commands to be submitted. Corrupting the data within that configuration API results in all traffic through ingress-nginx being dropped until an Ingress configuration change or a controller restart causes the data to be recreated correctly. In principle, this write access could also be used to redirect traffic from other Ingresses controlled by the same ingress-nginx instance. In practice, there is negligible additional risk: such redirection would require privileged information about internal ingress-nginx state, and users can already redirect traffic from other Ingresses controlled by the same ingress-nginx anyway.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-11-05

Last Modified

2026-11-05

Generated

2026-11-06

AI Q&A

2026-11-06

EPSS Evaluated

N/A

NVD

CVE-2026-116472

EUVD

EUVD-2026-117638

Affected Vendors & Products

Vendor	Product	Version / Range
Kubernetes	ingress-nginx	0
SUSE	Rancher Prime RKE2 ingress-nginx	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-20	The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Attack-Flow Graph

Executive Summary

This vulnerability affects ingress-nginx in Kubernetes clusters. A user with permission to create an Ingress can cause denial of service (DoS) on the ingress-nginx data plane or redirect traffic from other Ingresses. It occurs due to a missing check in the mirror-target Ingress annotation, which targets an unauthenticated configuration API in the ingress-nginx controller, allowing write commands. Corrupting this API drops all traffic until a configuration change or controller restart recreates the data.

Detection Guidance

Detection involves checking for localhost addresses in the mirror-target annotation of Ingress resources. Use kubectl commands to inspect Ingress configurations for the mirror-target annotation pointing to localhost or internal addresses.

Impact Analysis

If you use Kubernetes with ingress-nginx, an attacker with Ingress creation permissions could disrupt all traffic passing through ingress-nginx, causing downtime. They could also redirect traffic, though this requires privileged knowledge and is unlikely in practice. Clusters without ingress-nginx are unaffected.

Mitigation Strategies

Use an admission controller to block Ingresses with the mirror-target annotation. Alternatively, adjust the annotations-risk-level configMap parameter to Medium or Low. If using SUSE Rancher Prime RKE2, update to version 1.15.2-prime1.

Hi! I’m here to help you understand CVE-2026-116472. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...