CVE-2026-3288: ingress-nginx rewrite-target nginx configuration injection

Security readout for executives and security teams

A flaw in ingress-nginx, a widely used Kubernetes traffic router, lets an attacker who can create or modify Ingress objects inject malicious nginx configuration through the rewrite-target annotation. Successful abuse can run code inside the controller and expose secrets it can reach. In default installs, that means cluster-wide secrets, making this a serious risk for any Kubernetes environment using this component. Kubernetes clusters running ingress-nginx where any tenant, namespace user, or compromised workload can create or update Ingress resources are exposed. Multi-tenant clusters and shared platforms are at highest risk. Affected version range is not specified in the sources; treat all installs as potentially affected until vendor guidance confirms a fixed release. Treat as a near-term priority for any Kubernetes platform using ingress-nginx, particularly multi-tenant or internet-facing clusters. Authenticated, low-complexity attack with high impact and a public PoC lab raises urgency. Direct platform engineering to confirm version exposure, tighten Ingress RBAC, and apply vendor guidance once a patched release is identified. Mitigation focus: Check kubernetes/ingress-nginx advisories for a fixed release and upgrade controllers on all clusters.; Restrict who can create or edit Ingress resources via RBAC, especially in multi-tenant clusters.; Use admission policy (Kyverno, Gatekeeper, ValidatingAdmissionPolicy) to block or sanitize the rewrite-target annotation..

Prepared

May 1, 2026, 08:10 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.