CVE-2026-4342: Ingress-NGINX's Last Critical Patch Before the Project Went Permanently Unmaintained

In March 2026, the Kubernetes Security Response Committee disclosed CVE-2026-4342: a comment-based nginx configuration injection in Ingress-NGINX, CVSS 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Days after the fix shipped, the project’s own maintainers confirmed what many in the ecosystem had suspected for a while — Ingress-NGINX would be retired. The GitHub repository was archived read-only on March 24, 2026. CVE-2026-4342 is, for practical purposes, the last critical security patch the project will ever ship.

That matters well beyond the specific bug, because Ingress-NGINX isn’t a niche component. It’s the de facto default ingress controller across EKS, AKS, and GKE clusters, installed via Helm or the community manifests in a huge share of production environments regardless of cloud provider.

How the Vulnerability Worked

Ingress-NGINX renders user-supplied Ingress annotations into the controller’s generated nginx.conf. The advisory describes a specific combination of annotations that could smuggle nginx directives past the controller’s input validation inside what was meant to be treated as an inert comment — the injected content broke out of comment context and was interpreted as live configuration. Once rendered, that configuration executes in the context of the controller process.

The practical requirement to exploit it was low: the ability to create or modify an Ingress object in at least one namespace. In multi-tenant clusters — shared EKS/AKS/GKE clusters where application teams manage their own Ingress resources via GitOps or self-service namespaces — that’s a common permission, not a privileged one. A tenant that should only be able to expose their own service could instead reach code execution in the shared ingress controller.

The blast radius is what makes this severe rather than merely interesting: a default Ingress-NGINX installation runs with a ClusterRole that can read Secrets across the entire cluster. RCE in the controller means an attacker-controlled process sitting on every TLS certificate, service account token, and credential the controller can see — a direct path to cluster-wide lateral movement from a single-namespace Ingress-create permission.

Check Your Exposure

Confirm whether Ingress-NGINX is running and which version:

kubectl get pods --all-namespaces \
  --selector app.kubernetes.io/name=ingress-nginx \
  -o wide

kubectl get deployment -n ingress-nginx ingress-nginx-controller \
  -o jsonpath='{.spec.template.spec.containers[0].image}{"\n"}'

Anything prior to v1.13.9, v1.14.5, or v1.15.1 is vulnerable. Those are also, effectively, the final releases — there is no “upgrade to the latest version and stay current” path anymore. There is only “be on the last patched build.”

Remediation: Patch, Then Plan an Exit

1. Upgrade immediately if you haven’t. Pin to the fixed release for your branch and follow the project’s own upgrade guide before it, too, becomes stale:

helm upgrade ingress-nginx ingress-nginx/ingress-nginx \
  --namespace ingress-nginx \
  --set controller.image.tag=v1.15.1

2. Restrict who can touch Ingress objects. Don’t rely on the controller’s input validation as your only control. Scope RBAC so Ingress create/update is a reviewed privilege, not a default namespace-admin capability:

apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: ingress-editor
  namespace: team-checkout
rules:
  - apiGroups: ["networking.k8s.io"]
    resources: ["ingresses"]
    verbs: ["get", "list", "watch"]   # no create/update without separate review

3. Scope the controller’s Secret access. Replace the default cluster-wide ClusterRole with a namespaced Role/RoleBinding limited to the TLS secrets the controller actually serves, rather than every Secret in the cluster.

4. Add an admission policy for dangerous annotations. Use OPA Gatekeeper or Kyverno to block or flag *-snippet-style and other raw-config annotations that Ingress-NGINX has repeatedly had injection issues with (this is the second such CVE class, after CVE-2021-25742 and CVE-2026-3288’s rewrite-target variant):

apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: block-nginx-snippet-annotations
spec:
  validationFailureAction: Enforce
  rules:
    - name: deny-snippet-annotations
      match:
        resources:
          kinds: ["Ingress"]
      validate:
        message: "Raw nginx snippet annotations are not permitted."
        pattern:
          metadata:
            =(annotations):
              X(nginx.ingress.kubernetes.io/*-snippet): "null"

5. Start the migration conversation now. With upstream maintenance over, the sustainable path is the Gateway API, the Ingress API’s supported successor, or a commercially maintained fork (several vendors, including the original NGINX Inc. controller and third-party long-term-support offerings, now fill this gap). Check what your cloud’s managed Gateway API implementation supports:

kubectl get gatewayclass

The Takeaway

CVE-2026-4342 is fixed. The structural problem it exposed is not: the most common ingress layer across every major cloud is now permanently off the patch train. Treat your current Ingress-NGINX version as the last one you’ll ever get a security fix for, and budget the migration accordingly — not as a someday project, but as the actual remediation for every future vulnerability class this component will quietly accumulate.