ingress-nginx CVE-2026-116472 allows self-DOS via Ingress creation
Original title: [kubernetes] CVE-2026-116472: ingress-nginx mirror-target self-DOS
User with Ingress creation permission may cause denial of service or redirect traffic in ingress-nginx.
ingress-nginx has a security issue where an Ingress creator can cause DoS to the data plane or redirect traffic. Kubernetes not issuing fix since maintenance ended in March 2026. SUSE has issued a fix.
Unconfirmed: Kubernetes will not be issuing a fix
- Kubernetes clusters affected only if using ingress-nginx
- ingress-nginx maintenance ended in March 2026
- SUSE issued a fix for this CVE
Impact: denial of service or traffic redirection
- CVEs
- CVE-2026-116472
- Vendors
- Kubernetes
- Products
- ingress-nginx
- Organizations
- SUSE
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-116472 | ingress-nginx mirror-target annotation enables self-DOS | 2.7 | — |
From the original article
Posted by Tabitha Sable on Nov 05 Hello Kubernetes Community, A security issue was discovered in ingress-nginx where a user with permission to create an Ingress may be able to cause denial of service of the ingress-nginx data plane, or possibly redirect traffic from other Ingresses. Kubernetes clusters are only affected if they are using ingress-nginx.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.