{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-116472","assignerOrgId":"a6081bf6-c852-4425-ad4f-a67919267565","state":"PUBLISHED","assignerShortName":"kubernetes","dateReserved":"2026-10-26T22:36:13.547Z","datePublished":"2026-11-05T18:13:29.564Z","dateUpdated":"2026-11-05T22:05:45.488Z"},"containers":{"cna":{"title":"ingress-nginx mirror-target self-DOS","datePublic":"2026-11-05T17:49:00.000Z","problemTypes":[{"descriptions":[{"lang":"en","cweId":"CWE-20","description":"CWE-20 Improper input validation","type":"CWE"}]}],"impacts":[{"capecId":"CAPEC-176","descriptions":[{"lang":"en","value":"CAPEC-176 Configuration/Environment Manipulation"}]}],"affected":[{"vendor":"Kubernetes","product":"ingress-nginx","versions":[{"status":"affected","version":"0","lessThan":"*","versionType":"semver"}],"defaultStatus":"unaffected"},{"vendor":"SUSE","product":"Rancher Prime RKE2 ingress-nginx","versions":[{"status":"affected","version":"0","lessThan":"1.15.2-prime1","versionType":"custom"}],"defaultStatus":"unaffected"}],"descriptions":[{"lang":"en","value":"A security issue was discovered in ingress-nginx where a user with permission to create an Ingress may be able to cause denial of service of the ingress-nginx data plane, or possibly redirect traffic from other Ingresses. Kubernetes clusters are only affected if they are using ingress-nginx.\n\nDue to a missing check, the mirror-target Ingress annotation can be used to target an unauthenticated configuration API within the ingress-nginx controller, allowing write commands to be submitted. Corrupting the data within that configuration API results in all traffic through ingress-nginx being dropped until an Ingress configuration change or a controller restart causes the data to be recreated correctly.\n\nIn principle, this write access could also be used to redirect traffic from other Ingresses controlled by the same ingress-nginx instance. In practice, there is negligible additional risk: such redirection would require privileged information about internal ingress-nginx state, and users can already redirect traffic from other Ingresses controlled by the same ingress-nginx anyway.","supportingMedia":[{"type":"text/html","base64":false,"value":"A security issue was discovered in ingress-nginx where a user with permission to create an Ingress may be able to cause denial of service of the ingress-nginx data plane, or possibly redirect traffic from other Ingresses. Kubernetes clusters are only affected if they are using ingress-nginx.<br><br>Due to a missing check, the mirror-target Ingress annotation can be used to target an unauthenticated configuration API within the ingress-nginx controller, allowing write commands to be submitted. Corrupting the data within that configuration API results in all traffic through ingress-nginx being dropped until an Ingress configuration change or a controller restart causes the data to be recreated correctly.<br><br>In principle, this write access could also be used to redirect traffic from other Ingresses controlled by the same ingress-nginx instance. In practice, there is negligible additional risk: such redirection would require privileged information about internal ingress-nginx state, and users can already redirect traffic from other Ingresses controlled by the same ingress-nginx anyway."}]}],"references":[{"url":"https://github.com/kubernetes/kubernetes/issues/143852","tags":["vendor-advisory"]}],"metrics":[{"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}],"cvssV3_1":{"version":"3.1","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"LOW","baseSeverity":"LOW","baseScore":2.7,"vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L"}}],"credits":[{"lang":"en","value":"Victor Pereira","type":"finder"}],"source":{"discovery":"UNKNOWN"},"x_generator":{"engine":"Vulnogram 1.0.5"},"providerMetadata":{"orgId":"a6081bf6-c852-4425-ad4f-a67919267565","shortName":"kubernetes","dateUpdated":"2026-11-05T18:13:29.564Z"}},"adp":[{"title":"CVE Program Container","references":[{"url":"http://www.openwall.com/lists/oss-security/2026/11/05/4"}],"providerMetadata":{"orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE","dateUpdated":"2026-11-05T22:05:45.488Z"}}]}}