CVE-2026-3288

Katalog CVE

CVSS 8.8 · High EPSS 0,74%

Kerentanan Improper Input Validation pada kubernetes ingress-nginx. Skor CVSS 3.1 8.8 (High) menurut liggitt.net.

Deskripsi (NVD)

A security issue was discovered in ingress-nginx where the `nginx.ingress.kubernetes.io/rewrite-target` Ingress annotation can be used to inject configuration into nginx. This can lead to arbitrary code execution in the context of the ingress-nginx controller, and disclosure of Secrets accessible to the controller. (Note that in the default installation, the controller can access all Secrets cluster-wide.)

Rincian

Terbit di NVD

9 Maret 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

8.8 (High), sumber liggitt.net
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-20: Improper Input Validation

EPSS (30 hari)

0,74% peluang dieksploitasi; lebih tinggi dari 53,4% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/bvabhishek/CVE-2026-3288-lab mitigasi · advisory pihak ketiga
• https://github.com/kubernetes/kubernetes/issues/137560 issue tracking · advisory pihak ketiga
• http://www.openwall.com/lists/oss-security/2026/03/09/8 mailing list · advisory pihak ketiga