Ingress-nginx path sanitization can be bypassed

Description

References

• nvd.nist.gov/vuln/detail/CVE-2022-4886 · ADVISORY
• kubernetes/ingress-nginx · WEB
• kubernetes/ingress-nginx · PACKAGE
• groups.google.com/g/kubernetes-security-announce/c/ge7u3qCwZLI · WEB
• security.netapp.com/advisory/ntap-20240307-0013 · WEB
• openwall.com/lists/oss-security/2023/10/25/5 · WEB
• security.netapp.com/advisory/ntap-20240307-0013

Weitere Schwachstellen in k8s.io/ingress-nginx

• CVE-2026-4342HOCH 8.8A security issue was discovered in ingress-nginx where a combination of Ingress annotations can be used to inject configuration into nginx. …
• CVE-2026-24514MITTEL 6.5A security issue was discovered in ingress-nginx where the validating admission controller feature is subject to a denial of service conditi…
• CVE-2026-24513NIEDRIG 3.1A security issue was discovered in ingress-nginx where the protection afforded by the `auth-url` Ingress annotation may not be effective in …
• CVE-2026-24512HOCH 8.8A security issue was discovered in ingress-nginx where the `rules.http.paths.path` Ingress field can be used to inject configuration into ng…
• CVE-2026-1580HOCH 8.8A security issue was discovered in ingress-nginx where the `nginx.ingress.kubernetes.io/auth-method` Ingress annotation can be used to injec…