CVE-2026-4342
Published: 19 March 2026
Summary
CVE-2026-4342 is a high-severity Improper Input Validation (CWE-20) vulnerability in Kubernetes Nginx Ingress Controller. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 29.2% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-6 (Least Privilege) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2026-4342 is a vulnerability in ingress-nginx that enables attackers to use a combination of Ingress annotations to inject arbitrary configuration into nginx. This flaw allows arbitrary code execution within the context of the ingress-nginx controller and disclosure of Secrets accessible to the controller. In default installations, the controller has cluster-wide access to all Secrets. The issue, classified under CWE-20 (Improper Input Validation), carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and was published on 2026-03-19.
The attack requires network access and low privileges, such as those of a user able to create or modify Ingress resources in the Kubernetes cluster. Successful exploitation grants arbitrary code execution as the ingress-nginx controller process, enabling full control over the controller's capabilities, alongside exfiltration of all cluster Secrets accessible to it, which defaults to cluster-wide scope.
Mitigation details and further advisories are available in the referenced sources: https://github.com/kubernetes/kubernetes/issues/137893 and http://www.openwall.com/lists/oss-security/2026/03/19/9.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-13343
Vulnerability details
A security issue was discovered in ingress-nginx where a combination of Ingress annotations can be used to inject configuration into nginx. This can lead to arbitrary code execution in the context of the ingress-nginx controller, and disclosure of Secrets accessible…
more
to the controller. (Note that in the default installation, the controller can access all Secrets cluster-wide.)
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Vuln enables exploitation of public-facing ingress-nginx (T1190) for RCE-based privilege escalation from low-priv Ingress creator to controller (T1068) plus cluster secret disclosure (T1552).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly remediates the improper input validation flaw in ingress-nginx, preventing arbitrary configuration injection and code execution via Ingress annotations.
Requires validation of Ingress annotations as information inputs to block malicious nginx configuration injection leading to RCE.
Enforces least privilege via RBAC to restrict creation or modification of Ingress resources, blocking low-privilege attackers from exploiting the vulnerability.