IN
Product
ingress-nginx
21
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 1High 14Medium 5Low 1
Watch
Add ingress-nginx to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2025-1974 | 9.8 | Mar 24 | ingress-nginx admission controller RCE escalation Affected: through 1.11.4; 1.12.0 |
| CVE-2026-4342 | 8.8 | Mar 19 | ingress-nginx comment-based nginx configuration injection Affected: before 1.13.9; before 1.14.5; before 1.15.1 |
| CVE-2026-3288 | 8.8 | Mar 9 | ingress-nginx rewrite-target nginx configuration injection Affected: before 1.13.8; before 1.14.4; before 1.15.0 |
| CVE-2025-15566 | 8.8 | Feb 6 | ingress-nginx auth-proxy-set-headers nginx configuration injection Affected: before 1.12.5; before 1.13.1 |
| CVE-2026-24512 | 8.8 | Feb 3 | ingress-nginx auth-method nginx configuration injection Affected: before 1.13.7; before 1.14.3 |
| CVE-2026-1580 | 8.8 | Feb 3 | ingress-nginx auth-method nginx configuration injection Affected: before 1.13.7; before 1.14.3 |
| CVE-2025-24514 | 8.8 | Mar 24 | ingress-nginx controller - configuration injection via unsanitized auth-url annotation Affected: through 1.11.4; 1.12.0 |
| CVE-2025-1098 | 8.8 | Mar 24 | ingress-nginx controller - configuration injection via unsanitized mirror annotations Affected: through 1.11.4; 1.12.0 |
| CVE-2025-1097 | 8.8 | Mar 24 | ingress-nginx controller - configuration injection via unsanitized auth-tls-match-cn annotation Affected: through 1.11.4; 1.12.0 |
| CVE-2024-7646 | 8.8 | Aug 16 | A security issue was discovered in ingress-nginx where an actor with permission to create Ingress objects (in the `networking.k8s.io` or `extensions` API group) can bypass… Affected: 1.11.0 before 1.11.2; before 1.10.4 |
| CVE-2023-5044 | 8.8 | Oct 25 | Code injection via nginx.ingress.kubernetes.io/permanent-redirect annotation Affected: before 1.9.0 |
| CVE-2023-5043 | 8.8 | Oct 25 | Ingress nginx annotation injection causes arbitrary command execution Affected: before 1.9.0 |
| CVE-2021-25745 | 8.1 | May 6 | A security issue was discovered in ingress-nginx where a user that can create or update ingress objects can use the spec.rules[].http.paths[].path field of an Ingress object (in… Affected: before 1.2.0 |
| CVE-2021-25746 | 7.1 | May 6 | A security issue was discovered in ingress-nginx where a user that can create or update ingress objects can use .metadata.annotations in an Ingress object (in the… Affected: before 1.2.0 |
| CVE-2021-25742 | 7.1 | Oct 29 | A security issue was discovered in ingress-nginx where a user that can create or update ingress objects can use the custom snippets feature to obtain all secrets in the cluster Affected: before 0.49.1; 1.0.0 |
| CVE-2026-24514 | 6.5 | Feb 3 | ingress-nginx Admission Controller denial of service Affected: before 1.13.7; before 1.14.3 |
| CVE-2022-4886 | 6.5 | Oct 25 | Ingress-nginx `path` sanitization can be bypassed with `log_format` directive Affected: before 1.8.0 |
| CVE-2021-25748 | 6.5 | May 24 | A security issue was discovered in ingress-nginx where a user that can create or update ingress objects can use a newline character to bypass the sanitization of the… Affected: before 1.2.1 |
| CVE-2020-8553 | 5.9 | Jul 29 | The Kubernetes ingress-nginx component prior to version 0.28.0 allows a user with the ability to create namespaces and to read and create ingress objects to overwrite the password… Affected: before 0.28.0 |
| CVE-2025-24513 | 4.8 | Mar 24 | ingress-nginx controller - auth secret file path traversal vulnerability Affected: through 1.11.4; 1.12.0 |
| CVE-2026-24513 | 3.1 | Feb 3 | ingress-nginx auth-url protection bypass Affected: before 1.13.7; before 1.14.3 |
Showing 21