High WID-SEC-2026-0289 4 CVEs

Kubernetes (ingress-nginx): Mehrere Schwachstellen

Published Feb 2, 2026 · Updated Feb 8, 2026 · Revision 3 · de-DE

Vendor: SUSE Product: Linux

Summary

Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Kubernetes ausnutzen, um beliebigen Code auszuführen, Sicherheitsmaßnahmen zu umgehen, vertrauliche Informationen offenzulegen und einen Denial-of-Service-Zustand zu verursachen.

Product

Kubernetes ist ein Werkzeug zur Automatisierung der Bereitstellung, Skalierung und Verwaltung von containerisierten Anwendungen.

Vulnerabilities 4

High 8.8

CVE-2026-1580

ingress-nginx auth-method nginx configuration injection

A security issue was discovered in ingress-nginx where the `nginx.ingress.kubernetes.io/auth-method` Ingress annotation can be used to inject configuration into nginx. This can lead to arbitrary code execution in the context of the ingress-nginx controller, a…

Kubernetes ingress-nginx ingress-nginx-controller-1.12 k8s.io/ingress-nginx Wolfi Go

Feb 3, 2026
High 8.8

CVE-2026-24512

ingress-nginx auth-method nginx configuration injection

A security issue was discovered in ingress-nginx where the `rules.http.paths.path` Ingress field can be used to inject configuration into nginx. This can lead to arbitrary code execution in the context of the ingress-nginx controller, and disclosure of Secret…

Kubernetes ingress-nginx ingress-nginx-controller-1.12 k8s.io/ingress-nginx Wolfi Go

Feb 3, 2026
Medium 6.5

CVE-2026-24514 Public exploit

ingress-nginx Admission Controller denial of service

A security issue was discovered in ingress-nginx where the validating admission controller feature is subject to a denial of service condition. By sending large requests to the validating admission controller, an attacker can cause memory consumption, which m…

Kubernetes ingress-nginx ingress-nginx-controller-1.12 k8s.io/ingress-nginx Wolfi Go

Feb 3, 2026
Low 3.1

CVE-2026-24513

ingress-nginx auth-url protection bypass

A security issue was discovered in ingress-nginx where the protection afforded by the `auth-url` Ingress annotation may not be effective in the presence of a specific misconfiguration. If the ingress-nginx controller is configured with a default custom-errors…

Kubernetes ingress-nginx ingress-nginx-controller-1.12 k8s.io/ingress-nginx Wolfi Go

Feb 3, 2026

Revision history

2026-02-08 #3
Neue Updates von SUSE aufgenommen
2026-02-04 #2
Referenz(en) aufgenommen: EUVD-2026-5365, EUVD-2026-5383, EUVD-2026-5515
2026-02-02 #1
Initiale Fassung

References

Mailing List OSS-Security vom 2026-02-02
https://seclists.org/oss-sec/2026/q1/140
GitHub kubernetes Issue #136677 vom 2026-02-02
https://github.com/kubernetes/kubernetes/issues/136677
GitHub kubernetes Issue #136678 vom 2026-02-02
https://github.com/kubernetes/kubernetes/issues/136678
GitHub kubernetes Issue #136679 vom 2026-02-02
https://github.com/kubernetes/kubernetes/issues/136679
GitHub kubernetes Issue #136680 vom 2026-02-02
https://github.com/kubernetes/kubernetes/issues/136680
SUSE Security Update SUSE-SU-2026:0403-1 vom 2026-02-09
https://lists.suse.com/pipermail/sle-security-updates/2026-February/024084.html