{"id":"CVE-2026-3288","aliases":["EUVD-2026-10360","GHSA-c56h-j8gw-3v54"],"status":"published","title":"ingress-nginx rewrite-target nginx configuration injection","description":"A security issue was discovered in ingress-nginx where the `nginx.ingress.kubernetes.io/rewrite-target` Ingress annotation can be used to inject configuration into nginx. This can lead to arbitrary code execution in the context of the ingress-nginx controller, and disclosure of Secrets accessible to the controller. (Note that in the default installation, the controller can access all Secrets cluster-wide.)","severity":{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.06993,"percentile":0.94194,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"cwes":["CWE-20"],"published":"2026-03-09T21:00:48Z","modified":"2026-10-28T02:30:30Z","exploits":[{"source":"pocgithub","id":"SnailSploit/CVE-2026-3288","title":"SnailSploit/CVE-2026-3288","date":"2026-03-10","url":"https://github.com/SnailSploit/CVE-2026-3288"},{"source":"pocgithub","id":"bvabhishek/CVE-2026-3288-lab","title":"bvabhishek/CVE-2026-3288-lab","date":"2026-04-08","url":"https://github.com/bvabhishek/CVE-2026-3288-lab"}],"products":[{"vendor":"kubernetes","product":"ingress-nginx"}],"references":[{"url":"https://github.com/kubernetes/kubernetes/issues/137560","tags":["Issue Tracking","Third Party Advisory","report"]},{"url":"http://www.openwall.com/lists/oss-security/2026/03/09/8","tags":["Mailing List","Third Party Advisory","web"]},{"url":"https://github.com/bvabhishek/CVE-2026-3288-lab","tags":["exploit","Mitigation","Third Party Advisory","evidence"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-3288","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-c56h-j8gw-3v54"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/3xxx/CVE-2026-3288.json","tags":["advisory"]},{"url":"https://github.com/kubernetes/ingress-nginx","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-3288","title":"ingress-nginx rewrite-target nginx configuration injection","description":"A security issue was discovered in ingress-nginx where the `nginx.ingress.kubernetes.io/rewrite-target` Ingress annotation can be used to inject configuration into nginx. This can lead to arbitrary code execution in the context of the ingress-nginx controller, and disclosure of Secrets accessible to the controller. (Note that in the default installation, the controller can access all Secrets cluster-wide.)","status":"published","published":"2026-03-09T21:00:48.196Z","modified":"2026-04-30T12:40:52.366Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T13:48:58.05327Z"}],"euvd":[{"id":"EUVD-2026-10360","description":"A security issue was discovered in ingress-nginx where the `nginx.ingress.kubernetes.io/rewrite-target` Ingress annotation can be used to inject configuration into nginx. This can lead to arbitrary code execution in the context of the ingress-nginx controller, and disclosure of Secrets accessible to the controller. (Note that in the default installation, the controller can access all Secrets cluster-wide.)","status":"published","published":"2026-03-09T21:00:48Z","modified":"2026-04-30T12:40:52Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T19:05:19.116327Z"}],"ghsa":[{"id":"GHSA-c56h-j8gw-3v54","title":"A security issue was discovered in ingress-nginx where the `nginx.ingress.kubernetes.io/rewrite...","description":"A security issue was discovered in ingress-nginx where the `nginx.ingress.kubernetes.io/rewrite-target` Ingress annotation can be used to inject configuration into nginx. This can lead to arbitrary code execution in the context of the ingress-nginx controller, and disclosure of Secrets accessible to the controller. (Note that in the default installation, the controller can access all Secrets cluster-wide.)","status":"published","published":"2026-03-09T21:31:39Z","modified":"2026-04-30T15:30:31Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T15:07:52.236911Z"}],"nvd":[{"id":"CVE-2026-3288","description":"A security issue was discovered in ingress-nginx where the `nginx.ingress.kubernetes.io/rewrite-target` Ingress annotation can be used to inject configuration into nginx. This can lead to arbitrary code execution in the context of the ingress-nginx controller, and disclosure of Secrets accessible to the controller. (Note that in the default installation, the controller can access all Secrets cluster-wide.)","status":"published","published":"2026-03-09T21:16:20.9Z","modified":"2026-06-17T10:43:21.017Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:12:08.279852Z"}],"osv":[{"id":"CVE-2026-3288","title":"ingress-nginx rewrite-target nginx configuration injection","description":"A security issue was discovered in ingress-nginx where the `nginx.ingress.kubernetes.io/rewrite-target` Ingress annotation can be used to inject configuration into nginx. This can lead to arbitrary code execution in the context of the ingress-nginx controller, and disclosure of Secrets accessible to the controller. (Note that in the default installation, the controller can access all Secrets cluster-wide.)","status":"published","published":"2026-03-09T21:00:48.196Z","modified":"2026-10-28T02:30:30.61741454Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T15:45:01.548715Z"}]}}