Back Docs.Byteplus

[Vulnerability Alert] Ingres-nginx Command Injection Vulnerability (CVE-2026-4342)

Docs.Byteplus • March 21, 2026

Ingress-nginx is the Ingress controller for Kubernetes, using nginx as a reverse proxy and load balancer. On March 20, 2026, the Kubernetes community disclosed a code injection vulnerability in Ingress Nginx, allowing attackers with Ingress creation privileges to inject malicious configurations, obtain the secret, and take over the cluster.

As of March 20, 2026, 10:00:00 (UTC+8).

ingress-nginx < 1.13.9

1.14.0 <= ingress-nginx < 1.14.5

1.15.0 <= ingress-nginx < 1.15.1

Upgrade ingress-nginx to version 1.13.9、1.14.5、1.15.1, or higher.

Ingress-Nginx will soon cease official maintenance. Updates and vulnerability fixes will stop after March 2026. Please pay attention to alternative solutions and migrate in time

[Product announcement] NGINX Ingress EOM

Ingress NGINX Retirement: What You Need to Know

Install admittance holdout groups (e.g. Kyverno, Gatekeeper) in the cluster to verify the creation of Ingress objects and block exploit vulnerabilities.

Convergence creates Ingress permissions that are only authorized to trusted users.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical Code Execution Vulnerability in Kubernetes ingress-nginx Disclosed A high-severity vulnerability, CVE-2026-4342, was disclosed on March 19, 2026, affecting ingress-nginx versions prior to v1.13.9, v1.14.5, and v1.15.1. This vulnerability allows attackers with low-level privileges to inject arbitrary configurations into nginx through malicious Ingress annotations, potentially leading to full remote code execution and exposure of sensitive Kubernetes Secrets. Organizations using affected versions are urged to upgrade immediately to mitigate risks of data breaches and operational downtime. The vulnerability arises from insufficient validation of Ingress annotations, significantly amplifying the impact due to the default access to all Secrets cluster-wide. As of March 20, 2026, the Kubernetes community has recommended immediate patching and enhanced monitoring to detect suspicious activities. Additionally, ingress-nginx will cease official maintenance after March 2026, prompting users to consider alternative solutions. 2 sources 72

Extracted Entities

[Vulnerability Alert] Ingres-nginx Command Injection Vulnerability (CVE-2026-4342)

The full story

Extracted Entities

CVEs (1)

Platforms (2)

Tools (1)

Vulnerabilities (1)