# \[Security Advisory\] CVE-2026-116472: ingress-nginx mirror-target self-DOS

**URL:** <https://discuss.kubernetes.io/t/security-advisory-cve-2026-116472-ingress-nginx-mirror-target-self-dos/35554>\
**Category:** Announcements\
**Created:** [November 5, 2026, 5:39pm UTC](https://discuss.kubernetes.io/t/security-advisory-cve-2026-116472-ingress-nginx-mirror-target-self-dos/35554 "2026-11-05T17:39:33Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![Security\_k8s.io](https://avatars.discourse-cdn.com/v4/letter/s/da6949/32.png) [@Security\_k8s.io](https://discuss.kubernetes.io/u/Security_k8s.io)\
**Post date:** [November 5, 2026, 5:39pm UTC](https://discuss.kubernetes.io/t/security-advisory-cve-2026-116472-ingress-nginx-mirror-target-self-dos/35554/1 "2026-11-05T17:39:33Z")

</div>

Hello Kubernetes Community,

A security issue was discovered in ingress-nginx where a user with permission to create an Ingress may be able to cause denial of service of the ingress-nginx data plane, or possibly redirect traffic from other Ingresses. Kubernetes clusters are only affected if they are using ingress-nginx.

Kubernetes will not be issuing a fix for this CVE, because ingress-nginx maintenance ended in March 2026.

SUSE has issued a fix for this CVE in version 1.15.2-prime1 of their fork of ingress-nginx.

This issue has been rated 2.7 (LOW) ([Common Vulnerability Scoring System Version 3.1 Calculator](https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L)), and assigned CVE-2026-116472

### Am I vulnerable?

This issue affects ingress-nginx. If you do not have ingress-nginx installed on your cluster, you are not affected. You can check this by running `kubectl get pods --all-namespaces --selector app.kubernetes.io/name=ingress-nginx`.

### How do I mitigate this vulnerability?

Prior to upgrading, this vulnerability can be mitigated by using an admission controller to reject Ingresses that specify the mirror-target annotation, or by setting the annotations-risk-level configMap parameter to “Medium” or “Low”.

#### How to upgrade?

To upgrade, consult the documentation provided by your vendor.

Note that the Kubernetes project will not be issuing a fix for this CVE.

### Detection

Localhost addresses in the mirror-target annotation of an Ingress resource may indicate an attempt to exploit this vulnerability.

If you find evidence that this vulnerability has been exploited, please contact [security@kubernetes.io](mailto:security@kubernetes.io)

See the GitHub issue for more details: [PLACEHOLDER ISSUE · Issue #143852 · kubernetes/kubernetes · GitHub](https://github.com/kubernetes/kubernetes/issues/143852)

#### Acknowledgements

This vulnerability was reported by Victor Pereira.

Thank you,

Tabitha Sable on behalf of the Kubernetes Security Response Committee