CVE-2026-116472 · Infrastructure
NO FIX YET
A user allowed to create Ingress objects can abuse the mirror-target annotation to reach ingress-nginx's unauthenticated configuration API and submit write commands. Corrupting that data drops all traffic through the ingress controller until its configuration is regenerated or the controller restarts.
first public Nov 5, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Kubernetes clusters running ingress-nginx are affected, and only if some user other than trusted administrators can create Ingress objects. The source says the flaw sits in the mirror-target annotation, so clusters that do not use ingress-nginx can skip it. The sources say the redirection risk is negligible beyond the denial of service.
Not affected if ingress-creation-restricted-to-admins, not-using-ingress-nginx
Who cares ingress-nginx, kubernetes
kubectl get pods -A | grep ingress-nginxkubectl get deploy -A -o wide | grep ingress-nginxkubectl auth can-i create ingresses --as=<user>No fix yet, per the sources.
A security issue was discovered in ingress-nginx where a user with permission to create an Ingress may be able to cause denial of service of the ingress-nginx data plane, or possibly redirect traffic from other Ingresses. Kubernetes clusters are only affected if they are using ingress-nginx.
Due to a missing check, the mirror-target Ingress annotation can be used to target an unauthenticated configuration API within the ingress-nginx controller, allowing write commands to be submitted. Corrupting the data within that configuration API results in all traffic through ingress-nginx being dropped until an Ingress configuration change or a controller restart causes the data to be recreated correctly.
In principle, this write access could also be used to redirect traffic from other Ingresses controlled by the same ingress-nginx instance. In practice, there is negligible additional risk: such redirection would require privileged information about internal ingress-nginx state, and users can already redirect traffic from other Ingresses controlled by the same ingress-nginx anyway.
This page as ·
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.