Report feedback

Due to a misconfiguration in the handling of error responses, an unauthenticated remote attacker can bypass authentication protection and gain access to protected URLs. Exploitation is only possible when an incorrectly implemented external error-handling component is deployed, whereas the built-in mechanism works correctly [2].

The vulnerability is present in product:

• ingress-nginx; < 1.13.7; >=1.14.0, < v1.14.3

CVSS: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N

More information:

• CVE-2026-24513 at cve.org, NVD
• CWE-754: Improper Check for Unusual or Exceptional Conditions at cwe.mitre.org

The vulnerability was publicly disclosed 3. 2. 2026.

An authenticated remote attacker can exhaust system resources in Kubernetes ingress-nginx by sending excessively large requests to the admission control mechanism, which may lead to a DoS attack [3].

The vulnerability is present in product:

• ingress-nginx; < 1.13.7; >=1.14.0, < v1.14.3

CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

More information:

• CVE-2026-24514 at cve.org, NVD
• CWE-770: Allocation of Resources Without Limits or Throttling at cwe.mitre.org

The vulnerability was publicly disclosed 3. 2. 2026.

Due to insufficient validation of values, an authenticated remote attacker can execute code in the context of the ingress-nginx controller component, which may also lead to disclosure of the Kubernetes Secrets accessible to this controller [4][5].

The vulnerability is present in product:

• ingress-nginx; <1.13.7; >=1.14.0, <1.14.3

CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

More information:

• CVE-2026-1580 at cve.org, NVD
• CVE-2026-24512 at cve.org, NVD
• CWE-20: Improper Input Validation at cwe.mitre.org

The vulnerability was publicly disclosed 3. 2. 2026.