{"id":"CVE-2026-116472","kind":"vulnerability","aliases":["CVE-2026-116472"],"related":[],"title":"ingress-nginx: Ingress users can drop all cluster traffic via mirror annotation","description":"A security issue was discovered in ingress-nginx where a user with permission to create an Ingress may be able to cause denial of service of the ingress-nginx data plane, or possibly redirect traffic from other Ingresses. Kubernetes clusters are only affected if they are using ingress-nginx.\n\nDue to a missing check, the mirror-target Ingress annotation can be used to target an unauthenticated configuration API within the ingress-nginx controller, allowing write commands to be submitted. Corrupting the data within that configuration API results in all traffic through ingress-nginx being dropped until an Ingress configuration change or a controller restart causes the data to be recreated correctly.\n\nIn principle, this write access could also be used to redirect traffic from other Ingresses controlled by the same ingress-nginx instance. In practice, there is negligible additional risk: such redirection would require privileged information about internal ingress-nginx state, and users can already redirect traffic from other Ingresses controlled by the same ingress-nginx anyway.","summary":"A user allowed to create Ingress objects can abuse the mirror-target annotation to reach ingress-nginx's unauthenticated configuration API and submit write commands. Corrupting that data drops all traffic through the ingress controller until its configuration is regenerated or the controller restarts.","severity":"low","cvss":2.7,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["infrastructure","ingress-nginx","kubernetes"],"not_affected_if":["ingress-creation-restricted-to-admins","not-using-ingress-nginx"],"how_to_check":"- Check whether the cluster runs ingress-nginx, for example with `kubectl get pods -A | grep ingress-nginx`\n- Check the controller image version with `kubectl get deploy -A -o wide | grep ingress-nginx`\n- Check whether users outside cluster admins can create Ingress objects, using `kubectl auth can-i create ingresses --as=<user>`","fix":null,"status":"open","published_at":"2026-11-05T19:17:10+00:00","first_seen_at":"2026-11-05T19:40:35+00:00","triaged_at":"2026-11-05T19:43:32+00:00","updated_at":"2026-11-05T19:43:32+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-11-05T19:43:32Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"ingress-nginx: Ingress users can drop all cluster traffic via mirror annotation","impact":"medium","summary":"A user allowed to create Ingress objects can abuse the mirror-target annotation to reach ingress-nginx's unauthenticated configuration API and submit write commands. Corrupting that data drops all traffic through the ingress controller until its configuration is regenerated or the controller restarts.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["kubernetes","ingress-nginx"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"all traffic through the ingress controller is dropped","analyst_note":"Find the affected and fixed ingress-nginx versions and any mirror annotation mitigation in the NVD entry or the project's security advisory.","how_to_check":"- Check whether the cluster runs ingress-nginx, for example with `kubectl get pods -A | grep ingress-nginx`\n- Check the controller image version with `kubectl get deploy -A -o wide | grep ingress-nginx`\n- Check whether users outside cluster admins can create Ingress objects, using `kubectl auth can-i create ingresses --as=<user>`","plain_action":"","needs_analyst":true,"not_affected_if":["not-using-ingress-nginx","ingress-creation-restricted-to-admins"],"who_is_affected":"Kubernetes clusters running ingress-nginx are affected, and only if some user other than trusted administrators can create Ingress objects. The source says the flaw sits in the mirror-target annotation, so clusters that do not use ingress-nginx can skip it. The sources say the redirection risk is negligible beyond the denial of service.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"low"},"cost_usd":0.000769,"input_tokens":4450,"output_tokens":647,"severity_before":"low"},"analyst_status":null,"analyst_note":null,"search":"'-116472':16A,19A '-2026':15A,18A 'abl':91C 'abus':33B 'access':192C 'addit':216C 'affect':115C 'allow':27B,149C 'alreadi':233C 'also':194C 'annot':13A,38B,133C 'anyway':246C 'api':47B,142C,161C 'caus':93C,181C 'chang':176C 'check':127C 'cluster':9A,112C 'command':51B,151C 'configur':46B,64B,141C,160C,175C 'control':61B,69B,148C,179C,203C,239C 'correct':187C 'corrupt':52B,155C 'could':193C 'creat':29B,86C 'cve':14A,17A 'data':54B,102C,157C,183C 'denial':94C 'discov':75C 'drop':7A,55B,171C 'due':123C 'inform':223C 'infrastructur':20B 'ingress':2A,4A,22B,30B,42B,60B,78C,88C,100C,110C,121C,132C,146C,168C,174C,202C,208C,227C,238C,244C 'ingress-nginx':1A,21B,41B,77C,99C,120C,145C,167C,207C,226C,243C 'instanc':210C 'intern':225C 'issu':73C 'kubernet':24B,111C 'may':89C 'mirror':12A,36B,130C 'mirror-target':35B,129C 'miss':126C 'neglig':215C 'nginx':3A,23B,43B,79C,101C,122C,147C,169C,209C,228C,245C 'object':31B 'permiss':84C 'plane':103C 'possibl':105C 'practic':212C 'principl':189C 'privileg':222C 'reach':40B 'recreat':186C 'redirect':106C,198C,219C,234C 'regener':66B 'requir':221C 'restart':70B,180C 'result':162C 'risk':217C 'secur':72C 'servic':96C 'state':229C 'submit':49B,154C 'target':37B,131C,138C 'traffic':10A,57B,107C,165C,199C,235C 'unauthent':45B,140C 'use':119C,136C,196C 'user':5A,26B,82C,231C 'via':11A 'within':143C,158C 'would':220C 'write':50B,150C,191C","nicknames":[],"mitigations":[],"who_affected":"Kubernetes clusters running ingress-nginx are affected, and only if some user other than trusted administrators can create Ingress objects. The source says the flaw sits in the mirror-target annotation, so clusters that do not use ingress-nginx can skip it. The sources say the redirection risk is negligible beyond the denial of service.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["infrastructure","ingressnginx","kubernetes","low"],"campaign_type":null,"first_public_at":"2026-11-05T17:21:19+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L","cvss_by":"jordan@liggitt.net","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116472","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116472","severity":null,"published_at":"2026-11-05T19:17:10+00:00","modified_at":"2026-11-05T19:17:10+00:00","first_seen_at":"2026-11-05T19:40:35+00:00","fetched_at":"2026-11-05T19:40:35+00:00","note":null}],"documents":[{"id":80060,"url":"https://github.com/kubernetes/kubernetes/issues/143852","title":"Kubernetes CVE feed: CVSS Rating: **2.7** (LOW) [CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L](https:","kind":"vendor","source":"vendor","publisher":null,"text":"CVSS Rating: **2.7** (LOW) [CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L](https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L) A security issue was discovered in ingress-nginx where a user with permission to create an Ingress may be able to cause denial of service of the ingress-nginx data plane, or possibly redirect traffic from other Ingresses. Kubernetes clusters are only affected if they are using ingress-nginx. Due to a missing check, the mirror-target Ingress annotation can be used to target an unauthenticated configuration API within the ingress-nginx controller, allowing write commands to be submitted. Corrupting the data within that configuration API results in all traffic through ingress-nginx being dropped until an Ingress configuration change or a controller restart causes the data to be recreated correctly. In principle, this write access could also be used to redirect traffic from other Ingresses controlled by the same ingress-nginx instance. In practice, there is negligible additional risk: such redirection would require privileged information about internal ingress-nginx state, and users can already redirect traffic from other Ingresses controlled by the same ingress-nginx anyway. Kubernetes will not be issuing a fix for this CVE, because ingress-nginx maintenance ended in March 2026. SUSE has issued a fix for this CVE in version 1.15.2-prime1 of their fork of ingress-nginx. ### Am I vulnerable? This issue affects ingress-nginx. If you do not have ingress-nginx installed on your cluster, you are not affected. You can check this by running `kubectl get pods --all-namespaces --selector app.kubernetes.io/name=ingress-nginx`. ### How do I mitigate this vulnerability? Prior to upgrading, this vulnerability can be mitigated by using an admission controller to reject Ingresses that specify the mirror-target annotation, or by setting the annotations-risk-level configMap parameter to \"Medium\" or \"Low\". #### How to upgrade? To upgrade, consult the documentation provided by your vendor. Note that the Kubernetes project will not be issuing a fix for this CVE. ### Detection Localhost addresses in the mirror-target annotation of an Ingress resource may indicate an attempt to exploit this vulnerability. If you find evidence that this vulnerability has been exploited, please contact **security@kubernetes.io** #### Acknowledgements This vulnerability was reported by Victor Pereira. /area security /kind bug /committee security-response /label official-cve-feed /sig network /area ingress-nginx OSV format ```json osv { \"schema_version\": \"1.6.0\", \"id\": \"CVE-2026-116472\", \"modified\": \"2026-11-05T17:21:44Z\", \"summary\": \"ingress-nginx mirror-target self-DOS\", \"details\": \"A security issue was discovered in ingress-nginx where a user with permission to create an Ingress may be able to cause denial of service of the ingress-nginx data plane, or possibly redirect traffic from other Ingresses. Kubernetes clusters are only affected if they are using ingress-nginx.\\n\\nDue to a missing check, the mirror-target Ingress annotation can be used to target an unauthenticated configuration API within the ingress-nginx controller, allowing write commands to be submitted. Corrupting the data within that configuration API results in all traffic through ingress-nginx being dropped until an Ingress configuration change or a controller restart causes the data to be recreated correctly.\\n\\nIn principle, this write access could also be used to redirect traffic from other Ingresses controlled by the same ingress-nginx instance. In practice, there is negligible additional risk: such redirection would require privileged information about internal ingress-nginx state, and users can already redirect traffic from other Ingresses controlled by the same ingress-nginx anyway.\\n\\nKubernetes will not be issuing a fix for this CVE, because ingress-nginx maintenance ended in March 2026.\\n\\nSUSE has issued a fix for this CVE in version","published_at":"2026-11-05T17:21:19+00:00","relation":"advisory","confidence":null,"note":"Kubernetes CVE feed"}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}