Cyber ·
CVE-2026-116472: ingress-nginx allows self-inflicted DoS via mirror target
A user allowed to create an Ingress can cause denial of service in the ingress-nginx data plane or possibly redirect traffic from other Ingresses. The project ended maintenance in March 2026 and Kubernetes will not issue a fix.
Security advisory posted to the oss-sec list on 5 November 2026 by Tabitha Sable, identified as CVE-2026-116472. According to the text, a user authorized to create an Ingress can cause denial of service in the ingress-nginx data plane or, possibly, redirect traffic from other Ingresses. Kubernetes clusters are only affected if they use ingress-nginx.
The advisory states that Kubernetes will not issue a fix, because ingress-nginx maintenance ended in March 2026. The available excerpt also mentions that SUSE has issued a response, but the content of that response is not included in the summary here. The received text is a partial machine translation.
To consult and verify, find the original message in the 2026 fourth-quarter oss-sec list archive, message 523, and also check your Kubernetes distribution vendor's advisories. Do not assume the full scope without reading the original.
Original source: CVE-2026-116472: ingress-nginx — DoS próprio via destino de espelhamento