Kubernetes ingress-nginx Vulnerability Allows Code Execution and Info Disclosure

CERT-Bund Security Advisories

Published March 19th, 2026

Detected March 20th, 2026

Summary

CERT-Bund has issued a security advisory for Kubernetes ingress-nginx, detailing a vulnerability that allows authenticated remote attackers to execute arbitrary code and disclose sensitive information. The advisory affects versions prior to 1.13.9, 1.14.5, and 1.15.1, with a high CVSS base score of 8.8.

View original document View source feed page

What changed

This advisory from CERT-Bund (WID-SEC-2026-0801) addresses a critical vulnerability in open-source Kubernetes ingress-nginx. The flaw, affecting versions prior to 1.13.9, 1.14.5, and 1.15.1, allows authenticated remote attackers to execute arbitrary code with service privileges and disclose confidential information. The vulnerability has a high CVSS base score of 8.8.

Organizations using affected versions of Kubernetes ingress-nginx must update to a patched version immediately to mitigate the risk of code execution and information disclosure. This is a critical security update, and failure to patch could lead to system compromise. The advisory indicates mitigation is available, implying that patching is the recommended mitigation strategy.

What to do next

Update Kubernetes ingress-nginx to a patched version (e.g., >= 1.13.9, >= 1.14.5, or >= 1.15.1)
Review system logs for any signs of exploitation

Source document (simplified)

[WID-SEC-2026-0801] Kubernetes (ingress-nginx): Schwachstelle ermöglicht Ausführen von beliebigem Programmcode und die Offenlegung von Informationen CVSS Base Score 8.8 (hoch) CVSS Temporal Score 7.7 (hoch) Remoteangriff ja Datum 19.03.2026 Stand 20.03.2026 Mitigation ja

Betroffene Systeme

Betriebssystem

Linux
UNIX

Produktbeschreibung

Kubernetes ist ein Werkzeug zur Automatisierung der Bereitstellung, Skalierung und Verwaltung von containerisierten Anwendungen.

Produkte

19.03.2026
- Open Source Kubernetes ingress-nginx <1.13.9

Open Source Kubernetes ingress-nginx <1.14.5
Open Source Kubernetes ingress-nginx <1.15.1

Angriff

Ein entfernter, authentisierter Angreifer kann eine Schwachstelle in Kubernetes (ingress-nginx) ausnutzen, um beliebigen Programmcode mit den Rechten des Dienstes auszuführen und vertrauliche Informationen offenzulegen. CVE Informationen Versionshistorie Feedback zum Advisory geben