---
title: "Kubernetes ingress-nginx vulnerabilities and CVEs"
url: https://radicalnotion.ai/vendor/kubernetes/ingress-nginx
type: product
description: "Kubernetes ingress-nginx has 24 published CVEs, 0 in CISA KEV and 7 with public exploits."
updated: 2026-11-05
source: RadicalNotion.AI
license: CC BY-NC 4.0 (https://creativecommons.org/licenses/by-nc/4.0/)
---

# Kubernetes ingress-nginx vulnerabilities

Vendor: [Kubernetes](https://radicalnotion.ai/vendor/kubernetes)

- **Published CVEs:** 24
- **In CISA KEV:** 0
- **With a public exploit:** 7
- **With a patch:** 24
- **Average CVSS:** 7.4
- **First CVE:** 2020-01-09
- **Latest CVE:** 2026-11-05

## Severity breakdown

| Severity | CVEs |
| --- | --- |
| Critical | 1 |
| High | 16 |
| Medium | 5 |
| Low | 2 |
| Unscored | 0 |

## Most common weakness types

| CWE | Name | CVEs |
| --- | --- | --- |
| [CWE-20](https://radicalnotion.ai/cwe/cwe-20) | Improper Input Validation | 18 |
| [CWE-215](https://radicalnotion.ai/cwe/cwe-215) | Insertion of Sensitive Information Into Debugging Code | 1 |
| [CWE-444](https://radicalnotion.ai/cwe/cwe-444) | Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') | 1 |
| [CWE-653](https://radicalnotion.ai/cwe/cwe-653) | Improper Isolation or Compartmentalization | 1 |
| [CWE-73](https://radicalnotion.ai/cwe/cwe-73) | External Control of File Name or Path | 1 |
| [CWE-754](https://radicalnotion.ai/cwe/cwe-754) | Improper Check for Unusual or Exceptional Conditions | 1 |
| [CWE-770](https://radicalnotion.ai/cwe/cwe-770) | Allocation of Resources Without Limits or Throttling | 1 |

## CVEs by year

| Year | CVEs published |
| --- | --- |
| 2020 | 3 |
| 2021 | 1 |
| 2022 | 2 |
| 2023 | 4 |
| 2024 | 1 |
| 2025 | 5 |
| 2026 | 8 |

## Affected versions (top 36 of 360)

| Version | Kind | CVEs |
| --- | --- | --- |
| controller-v0.34.0 | exact | 20 |
| controller-v0.34.1 | exact | 20 |
| controller-v0.35.0 | exact | 20 |
| controller-v0.40.0 | exact | 20 |
| controller-v0.40.1 | exact | 20 |
| controller-v0.40.2 | exact | 20 |
| controller-v0.41.0 | exact | 20 |
| controller-v0.41.1 | exact | 20 |
| controller-v0.41.2 | exact | 20 |
| controller-v0.42.0 | exact | 20 |
| controller-v0.43.0 | exact | 20 |
| controller-v0.44.0 | exact | 20 |
| \<= 1.11.4 | range | 5 |
| \>= 1.12.0 | range | 5 |
| \< 1.13.7 | range | 4 |
| \< 1.14.2 | range | 2 |
| \< 1.14.3 | range | 2 |
| \< 1.2.0 | range | 2 |
| \< 1.9.0 | range | 2 |
| \>= 1.9.0 | range | 2 |
| \< 0.28.0 | range | 1 |
| \< 0.49.1 | range | 1 |
| \< 1.10.4 | range | 1 |
| \< 1.12.5 | range | 1 |
| 1.13.7 | patched | 4 |
| 1.14.2 | patched | 2 |
| 1.14.3 | patched | 2 |
| 1.2.0 | patched | 2 |
| 1.9.0 | patched | 2 |
| 0.28.0 | patched | 1 |
| 0.49.1 | patched | 1 |
| 1.10.4 | patched | 1 |
| 1.11.2 | patched | 1 |
| 1.12.5 | patched | 1 |
| 1.13.1 | patched | 1 |
| 1.13.8 | patched | 1 |

## CVEs

| CVE | Title | Severity | CVSS | CISA KEV | Public exploit | Patch |
| --- | --- | --- | --- | --- | --- | --- |
| CVE-2026-116472 | ingress-nginx mirror-target self-DOS | low | 2.7 | No | No | Yes |
| CVE-2026-4342 | ingress-nginx comment-based nginx configuration injection | high | 8.8 | No | No | Yes |
| CVE-2026-3288 | ingress-nginx rewrite-target nginx configuration injection | high | 8.8 | No | Yes | Yes |
| CVE-2025-15566 | ingress-nginx auth-proxy-set-headers nginx configuration injection | high | 8.8 | No | No | Yes |
| CVE-2026-24514 | ingress-nginx Admission Controller denial of service | medium | 6.5 | No | No | Yes |
| CVE-2026-24513 | ingress-nginx auth-url protection bypass | low | 3.1 | No | No | Yes |
| CVE-2026-24512 | ingress-nginx auth-method nginx configuration injection | high | 8.8 | No | No | Yes |
| CVE-2026-1580 | ingress-nginx auth-method nginx configuration injection | high | 8.8 | No | No | Yes |
| CVE-2025-24514 | ingress-nginx controller - configuration injection via unsanitized auth-url annotation | high | 8.8 | No | Yes | Yes |
| CVE-2025-24513 | ingress-nginx controller - auth secret file path traversal vulnerability | medium | 4.8 | No | No | Yes |
| CVE-2025-1098 | ingress-nginx controller - configuration injection via unsanitized mirror annotations | high | 8.8 | No | Yes | Yes |
| CVE-2025-1097 | ingress-nginx controller - configuration injection via unsanitized auth-tls-match-cn annotation | high | 8.8 | No | Yes | Yes |
| CVE-2025-1974 | ingress-nginx admission controller RCE escalation | critical | 9.8 | No | Yes | Yes |
| CVE-2024-7646 | - | high | 8.8 | No | No | Yes |
| CVE-2023-5044 | Code injection via nginx.ingress.kubernetes.io/permanent-redirect annotation | high | 7.2 | No | No | Yes |
| CVE-2023-5043 | Ingress nginx annotation injection causes arbitrary command execution | high | 8.8 | No | No | Yes |
| CVE-2022-4886 | Ingress-nginx \`path\` sanitization can be bypassed with \`log\_format\` directive | high | 8.8 | No | No | Yes |
| CVE-2021-25748 | Ingress-nginx \`path\` sanitization can be bypassed with newline character | high | 7.6 | No | No | Yes |
| CVE-2021-25746 | Ingress-nginx directive injection via annotations | high | 7.6 | No | No | Yes |
| CVE-2021-25745 | Ingress-nginx path can be pointed to service account token file | high | 8.1 | No | No | Yes |
| CVE-2021-25742 | Ingress-nginx custom snippets allows retrieval of ingress-nginx serviceaccount token and secrets across all namespaces | high | 7.6 | No | Yes | Yes |
| CVE-2020-8553 | Kubernetes ingress-nginx Compromise of auth via subset/superset namespace names | medium | 5.9 | No | No | Yes |
| CVE-2018-1002104 | Kubernetes ingress exposes sensitive information | medium | 5.3 | No | No | Yes |
| CVE-2019-20372 | - | medium | 5.3 | No | Yes | Yes |

## Frequently asked questions

### How many CVEs does Kubernetes ingress-nginx have?

Kubernetes ingress-nginx has 24 published CVE records since 2020.

### How many Kubernetes ingress-nginx CVEs are in CISA KEV?

None of Kubernetes ingress-nginx's CVEs are currently listed in CISA's Known Exploited Vulnerabilities catalog.

### Are there public exploits for Kubernetes ingress-nginx vulnerabilities?

Yes — 7 of Kubernetes ingress-nginx's CVEs have a known public exploit.

### Which versions of Kubernetes ingress-nginx are affected?

360 distinct Kubernetes ingress-nginx versions are named across its CVEs. Use the version filter above to see the CVEs affecting a specific version.

### What are the most common weakness types in Kubernetes ingress-nginx CVEs?

Kubernetes ingress-nginx's CVEs most often map to these CWE weakness types: CWE-20 (Improper Input Validation), CWE-215 (Insertion of Sensitive Information Into Debugging Code), CWE-444 (Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')), CWE-653 (Improper Isolation or Compartmentalization).

### How many critical Kubernetes ingress-nginx vulnerabilities are there?

Kubernetes ingress-nginx has 1 critical and 16 high-severity CVEs.

### What is the average severity of Kubernetes ingress-nginx CVEs?

The average CVSS base score across Kubernetes ingress-nginx's scored CVEs is 7.4.

## Other products from this vendor

- [Kubernetes](https://radicalnotion.ai/vendor/kubernetes/kubernetes) (78 CVEs)
- [cri-o](https://radicalnotion.ai/vendor/kubernetes/cri-o) (10 CVEs)
- [github.com/kubernetes/kubernetes](https://radicalnotion.ai/vendor/kubernetes/github-com-kubernetes-kubernetes) (9 CVEs)
- [Kubelet](https://radicalnotion.ai/vendor/kubernetes/kubelet) (7 CVEs)
- [Kubernetes ingress-nginx](https://radicalnotion.ai/vendor/kubernetes/kubernetes-ingress-nginx) (4 CVEs)
- [Image Builder](https://radicalnotion.ai/vendor/kubernetes/image-builder) (3 CVEs)
- [kube-apiserver](https://radicalnotion.ai/vendor/kubernetes/kube-apiserver) (3 CVEs)
- [Minikube](https://radicalnotion.ai/vendor/kubernetes/minikube) (3 CVEs)

---

Source: [RadicalNotion.AI](https://radicalnotion.ai/vendor/kubernetes/ingress-nginx). Licensed CC BY-NC 4.0; attribute RadicalNotion.AI and link the source page when you reuse this data.