Product by Kubernetes
Kubernetes ingress-nginx
21 known vulnerabilities in Kubernetes ingress-nginx (Kubernetes), 0 of them actively exploited (CISA KEV).
Key figures
21
Vulnerabilities
0
Actively exploited (KEV)
0
Used by ransomware
1
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.
| Critical | CVE-2025-1974 | ingress-nginx admission controller RCE escalation | 9.8 | |
| High | CVE-2025-1098 | ingress-nginx controller - configuration injection via unsanitized mirror annotations | 8.8 | |
| High | CVE-2025-24514 | ingress-nginx controller - configuration injection via unsanitized auth-url annotation | 8.8 | |
| High | CVE-2025-1097 | ingress-nginx controller - configuration injection via unsanitized auth-tls-match-cn annotation | 8.8 | |
| High | CVE-2026-3288 | ingress-nginx rewrite-target nginx configuration injection | 8.8 | |
| High | CVE-2024-7646 | Kubernetes Ingress-nginx: Improper Input Validation | 8.8 | |
| High | CVE-2023-5044 | Code injection via nginx.ingress.kubernetes.io/permanent-redirect annotation | 7.6 | |
| High | CVE-2026-4342 | ingress-nginx comment-based nginx configuration injection | 8.8 | |
| High | CVE-2023-5043 | Ingress nginx annotation injection causes arbitrary command execution | 7.6 | |
| Medium | CVE-2025-24513 | ingress-nginx controller - auth secret file path traversal vulnerability | 4.8 | |
| High | CVE-2022-4886 | Ingress-nginx `path` sanitization can be bypassed with `log_format` directive | 8.8 | |
| High | CVE-2021-25742 | Kubernetes ingress-nginx: Improper Input Validation | 7.6 | |
| High | CVE-2021-25746 | Ingress-nginx directive injection via annotations | 7.6 | |
| High | CVE-2021-25745 | Ingress-nginx path can be pointed to service account token file | 7.6 | |
| High | CVE-2026-24512 | ingress-nginx auth-method nginx configuration injection | 8.8 | |
| High | CVE-2026-1580 | ingress-nginx auth-method nginx configuration injection | 8.8 | |
| High | CVE-2025-15566 | ingress-nginx auth-proxy-set-headers nginx configuration injection | 8.8 | |
| High | CVE-2021-25748 | Ingress-nginx `path` sanitization can be bypassed with newline character | 7.6 | |
| Medium | CVE-2026-24514 | ingress-nginx Admission Controller denial of service | 6.5 | |
| Medium | CVE-2020-8553 | Kubernetes ingress-nginx Compromise of auth via subset/superset namespace names | 5.9 | |
| Low | CVE-2026-24513 | ingress-nginx auth-url protection bypass | 3.1 |