CVE-2026-3288 — Improper Input Validation in Kubernetes Ingress-nginx

CWE-20 — Improper Input Validation4 documents4 sources
Severity
8.8HIGHNVD
EPSS
0.1%
top 83.68%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Kubernetes Ingress-nginx
Timeline
PublishedMar 9

Description

A security issue was discovered in ingress-nginx where the `nginx.ingress.kubernetes.io/rewrite-target` Ingress annotation can be used to inject configuration into nginx. This can lead to arbitrary code execution in the context of the ingress-nginx controller, and disclosure of Secrets accessible to the controller. (Note that in the default installation, the controller can access all Secrets cluster-wide.)

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 2.8 | Impact: 5.9

Affected Packages1 packages

▶CVEListV5kubernetes/ingress-nginx< 1.13.8+2

🔴Vulnerability Details

2
CVEList
ingress-nginx rewrite-target nginx configuration injection↗2026-03-09
▶
GHSA
GHSA-c56h-j8gw-3v54: A security issue was discovered in ingress-nginx where the `nginx↗2026-03-09
▶

🕵️Threat Intelligence

1
Wiz
CVE-2026-3288 Impact, Exploitability, and Mitigation Steps | Wiz↗
▶
CVE-2026-3288 — Improper Input Validation in Kubernetes | cvebase