Hello Kubernetes Community,
A security issue was discovered in ingress-nginx where a user with permission to create an Ingress may be able to cause denial of service of the ingress-nginx data plane, or possibly redirect traffic from other Ingresses. Kubernetes clusters are only affected if they are using ingress-nginx.
Kubernetes will not be issuing a fix for this CVE, because ingress-nginx maintenance ended in March 2026.
SUSE has issued a fix for this CVE in version 1.15.2-prime1 of their fork of ingress-nginx.
This issue has been rated 2.7 (LOW) (Common Vulnerability Scoring System Version 3.1 Calculator), and assigned CVE-2026-116472
Am I vulnerable?
This issue affects ingress-nginx. If you do not have ingress-nginx installed on your cluster, you are not affected. You can check this by running kubectl get pods --all-namespaces --selector app.kubernetes.io/name=ingress-nginx.
How do I mitigate this vulnerability?
Prior to upgrading, this vulnerability can be mitigated by using an admission controller to reject Ingresses that specify the mirror-target annotation, or by setting the annotations-risk-level configMap parameter to “Medium” or “Low”.
How to upgrade?
To upgrade, consult the documentation provided by your vendor.
Note that the Kubernetes project will not be issuing a fix for this CVE.
Detection
Localhost addresses in the mirror-target annotation of an Ingress resource may indicate an attempt to exploit this vulnerability.
If you find evidence that this vulnerability has been exploited, please contact security@kubernetes.io
See the GitHub issue for more details: PLACEHOLDER ISSUE · Issue #143852 · kubernetes/kubernetes · GitHub
Acknowledgements
This vulnerability was reported by Victor Pereira.
Thank you,
Tabitha Sable on behalf of the Kubernetes Security Response Committee