8.8

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-1580

CVE-2026-1580: ingress-nginx's `nginx.ingress.kubernetes.io/auth-method` Ingress annotation can be used to inject configuration into nginx

A security issue was discovered in ingress-nginx where the nginx.ingress.kubernetes.io/auth-method Ingress annotation can be used to inject configuration into nginx. This can lead to arbitrary code execution in the context of the ingress-nginx controller, and disclosure of Secrets accessible to the controller. (Note that in the default installation, the controller can access all Secrets cluster-wide.)

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-1580

CVE-2026-1580:

8.8

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
k8s.io/ingress-nginx	go	< 1.13.7	1.13.7
k8s.io/ingress-nginx	go	>= 1.14.0, < 1.14.3	1.14.3

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability, identified as CVE-2026-1580, stems from improper input validation in the ingress-nginx controller, which allows for the injection of arbitrary configuration into the nginx server. This can lead to remote code execution or information disclosure.

The analysis of the patches between the vulnerable version 1.13.6 and the fixed version 1.13.7 revealed two primary points of vulnerability:

auth-method Annotation Injection: The core of the reported vulnerability lies in the parsing of the nginx.ingress.kubernetes.io/auth-method annotation. The regular expression used for validation lacked start and end anchors (^ and $). This oversight allowed an attacker to append arbitrary nginx configuration directives to a valid HTTP method (e.g., GET, <injected_config>), which would then be written to the nginx configuration file. The fix, found in commit a91d165fcc9309f5739c5dc42c8a7497381ce111, was to add these anchors to the regex to ensure the entire string matches a valid HTTP method.
location and server_name Directive Injection: A broader configuration injection vulnerability was discovered and fixed in commit c423b85bee1ed47af95d27a7ddb7cfe3c73c1070. The buildLocation function in internal/ingress/controller/template/template.go and the nginx.tmpl template did not properly sanitize or quote values used in location and server_name directives. This allowed an attacker to craft malicious Ingress paths, hostnames, or aliases containing special characters (", \) to inject arbitrary nginx configuration. The fix involved introducing a sanitizeQuotedRegex function to escape these characters and ensuring all relevant values are properly quoted in the final configuration.

In summary, the root cause is a failure to properly sanitize user-provided input from Ingress objects before incorporating it into the nginx configuration. This allowed attackers to inject malicious directives, compromising the security of the ingress controller and potentially the entire cluster.

Vulnerable functions

k8s.io/ingress-nginx/internal/ingress/annotations/authreq.Parse

internal/ingress/annotations/authreq/main.go

The function responsible for parsing the `nginx.ingress.kubernetes.io/auth-method` annotation used a regular expression that was missing start and end anchors (`^` and `$`). This allowed an attacker to inject arbitrary nginx configuration by providing a value such as `GET, location /foo { return 200 "exploited"; }`. The part of the string after the comma would be injected into the nginx configuration file, leading to arbitrary code execution. The function name `Parse` is inferred based on common practice, as the actual function name is not present in the patch.

k8s.io/ingress-nginx/internal/ingress/controller/template.buildLocation

internal/ingress/controller/template/template.go

The `buildLocation` function constructs the `location` directive for the nginx configuration from the Ingress path. The original implementation did not sanitize the path, allowing an attacker to use special characters like `"` and `\` to break out of the configuration string and inject arbitrary nginx directives. The patch introduces the `sanitizeQuotedRegex` function to escape these characters and quotes the path to prevent injection.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.