Denial of Service and Traffic Redirection Vulnerability in Ingress-Nginx by Kubernetes
CVE-2026-116472

2.7LOW

Key Information:

Vendor

Kubernetes
Status
Ingress-nginx
Rancher Prime Rke2 Ingress-nginx
Vendor
CVE Published:
5 November 2026

What is CVE-2026-116472?

A security issue in ingress-nginx allows users with permission to create Ingresses to exploit a missing check within the configuration API. This could lead to denial of service for the ingress-nginx data plane, as corrupted configurations cause all incoming traffic to be dropped. Additionally, with sufficient knowledge of internal state, it may allow for the redirection of traffic from other Ingresses managed by the same instance. While this risk is deemed limited, it poses a significant concern for Kubernetes clusters utilizing ingress-nginx without proper safeguards.

Affected Version(s)

ingress-nginx 0

Rancher Prime RKE2 ingress-nginx 0 < 1.15.2-prime1

References

https://github.com/kubernetes/kubernetes/issues/143852
vendor-advisory

CVSS V3.1

Score:
2.7
Severity:
LOW
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Victor Pereira
.