CVE-2026-24512
Published: 03 February 2026
Summary
CVE-2026-24512 is a high-severity Improper Input Validation (CWE-20) vulnerability. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 38.9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-6 (Least Privilege) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2026-24512 is a vulnerability in ingress-nginx that allows the `rules.http.paths.path` Ingress field to inject arbitrary configuration into nginx. This issue affects the ingress-nginx controller, enabling arbitrary code execution within the controller's context and disclosure of Secrets accessible to it. In default installations, the controller can access all Secrets cluster-wide.
The vulnerability carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating network accessibility, low attack complexity, and a requirement for low privileges, such as the ability to create or modify Ingress resources. Exploitation requires no user interaction and results in high impacts to confidentiality, integrity, and availability, including remote arbitrary code execution and broad Secret disclosure.
Mitigation details are available in the Kubernetes GitHub issue at https://github.com/kubernetes/kubernetes/issues/136678.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-5365
Vulnerability details
A security issue was discovered in ingress-nginx where the `rules.http.paths.path` Ingress field can be used to inject configuration into nginx. This can lead to arbitrary code execution in the context of the ingress-nginx controller, and disclosure of Secrets accessible to…
more
the controller. (Note that in the default installation, the controller can access all Secrets cluster-wide.)
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Vulnerability directly enables exploitation of public-facing ingress-nginx controller (T1190) for RCE plus broad Kubernetes Secret/credential disclosure (T1552).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Requires timely remediation of the specific flaw in ingress-nginx that enables arbitrary nginx configuration injection via Ingress path fields, preventing RCE and Secret disclosure.
Mandates validation of information inputs like Ingress rules.http.paths.path fields to block malicious configuration injection into nginx.
Enforces least privilege via RBAC to limit creation or modification of Ingress resources, blocking low-privilege attackers from injecting malicious paths.