CVE-2026-24512
Published: 03 February 2026
Summary
CVE-2026-24512 is a high-severity Improper Input Validation (CWE-20) vulnerability. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 23.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-6 (Least Privilege) and SI-10 (Information Input Validation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Requires timely remediation of the specific flaw in ingress-nginx that enables arbitrary nginx configuration injection via Ingress path fields, preventing RCE and Secret disclosure.
Mandates validation of information inputs like Ingress rules.http.paths.path fields to block malicious configuration injection into nginx.
Enforces least privilege via RBAC to limit creation or modification of Ingress resources, blocking low-privilege attackers from injecting malicious paths.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Vulnerability directly enables exploitation of public-facing ingress-nginx controller (T1190) for RCE plus broad Kubernetes Secret/credential disclosure (T1552).
NVD Description
A security issue was discovered in ingress-nginx where the `rules.http.paths.path` Ingress field can be used to inject configuration into nginx. This can lead to arbitrary code execution in the context of the ingress-nginx controller, and disclosure of Secrets accessible to…
more
the controller. (Note that in the default installation, the controller can access all Secrets cluster-wide.)
Deeper analysisAI
CVE-2026-24512 is a vulnerability in ingress-nginx that allows the `rules.http.paths.path` Ingress field to inject arbitrary configuration into nginx. This issue affects the ingress-nginx controller, enabling arbitrary code execution within the controller's context and disclosure of Secrets accessible to it. In default installations, the controller can access all Secrets cluster-wide.
The vulnerability carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating network accessibility, low attack complexity, and a requirement for low privileges, such as the ability to create or modify Ingress resources. Exploitation requires no user interaction and results in high impacts to confidentiality, integrity, and availability, including remote arbitrary code execution and broad Secret disclosure.
Mitigation details are available in the Kubernetes GitHub issue at https://github.com/kubernetes/kubernetes/issues/136678.
Details
- CWE(s)