3.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-24513

CVE-2026-24513: ingress-nginx has Improper Check for Unusual or Exceptional Conditions

A security issue was discovered in ingress-nginx where the protection afforded by the auth-url Ingress annotation may not be effective in the presence of a specific misconfiguration.

If the ingress-nginx controller is configured with a default custom-errors configuration that includes HTTP errors 401 or 403, and if the configured default custom-errors backend is defective and fails to respect the X-Code HTTP header, then an Ingress with the auth-url annotation may be accessed even when authentication fails.

Note that the built-in custom-errors backend works correctly. Triggering this issue requires an administrator to specifically configure ingress-nginx with a broken external component.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-24513

CVE-2026-24513:

3.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
k8s.io/ingress-nginx	go	< 1.13.7	1.13.7
k8s.io/ingress-nginx	go	>= 1.14.0, < 1.14.3	1.14.3

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in the generated NGINX configuration, not in a specific Go function that has a memory corruption or similar flaw. The Go code in the ingress-nginx controller is responsible for generating this configuration based on a Go template file (nginx.tmpl). The vulnerability was that for authentication subrequests (auth-url), the template did not include proxy_intercept_errors off;. This meant that if the authentication backend returned an error (like 401 Unauthorized), NGINX would intercept it and try to serve a custom error page. If a misconfigured custom error backend then returned a 200 OK response, the authentication check would be bypassed.

The patch for this vulnerability was to add proxy_intercept_errors off; to the relevant section of the nginx.tmpl file, as seen in commit 9685608059fff03918e05356f02ebc4e20c50917. This ensures that errors from the authentication backend are not intercepted by the custom error page mechanism and are handled correctly by the ingress-nginx logic.

From a runtime profiling perspective of the controller, the functions responsible for generating the configuration would be active when an Ingress is created or updated. The function NGINXController.OnUpdate is the high-level function that starts this process. It calls other functions, eventually leading to NGINXController.syncNginxConfig, which directly executes the template. Therefore, both of these functions are relevant as they are part of the chain that produces the vulnerable configuration.

Vulnerable functions

NGINXController.OnUpdate

internal/ingress/controller/controller.go

This function is the main entry point for processing configuration updates. When an Ingress object is created or modified, this function is called. It orchestrates the generation of a new NGINX configuration. The vulnerability lies in the generated configuration due to a flaw in the underlying template (`nginx.tmpl`). This function initiates the process that leads to the creation of the vulnerable configuration file.

NGINXController.syncNginxConfig

internal/ingress/controller/nginx.go

This function is directly responsible for rendering the vulnerable NGINX configuration. It takes the generated configuration data and executes the `nginx.tmpl` template, writing the output to the `nginx.conf` file. The vulnerability was in the template's logic, and this function is the one that executes it, thus creating the flawed configuration that could be exploited.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.