CVE-2026-24513: 
Ingress NGINX Controller (community-driven) vulnerability analysis and mitigation

CVE-2026-24513 is an authentication bypass vulnerability in Kubernetes ingress-nginx, classified as "ingress-nginx auth-url protection bypass." It affects ingress-nginx versions prior to 1.13.7 and versions 1.14.0 through 1.14.2 (prior to 1.14.3). The vulnerability was discovered by Aurelia Schittler, disclosed on February 2–3, 2026, and patched versions were published on February 4, 2026. It carries a CVSS v3.1 base score of 3.1 (Low) (GitHub Advisory, Kubernetes Issue).

The root cause is classified as CWE-754 (Improper Check for Unusual or Exceptional Conditions). When ingress-nginx is configured with a default custom-errors backend that intercepts HTTP 401 or 403 responses, and that backend is defective and fails to properly respect the X-Code HTTP header, the controller cannot correctly propagate authentication failure signals. As a result, requests that should be blocked by the auth-url annotation are allowed through, effectively bypassing the external authentication service. Exploitation requires a low-privileged network attacker and a specific administrator misconfiguration — the built-in custom-errors backend is not affected (GitHub Advisory, Kubernetes Issue).

Successful exploitation allows a low-privileged attacker to access Ingress-protected resources that should require authentication, resulting in unauthorized disclosure of confidential data (low confidentiality impact). There is no integrity or availability impact. The scope is limited to the affected ingress-nginx instance and the backend services it proxies; lateral movement potential is low given the constrained attack conditions (GitHub Advisory, Kubernetes Issue).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of disclosure. The EPSS score is approximately 0.033% (3rd percentile), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires a specific and unusual administrator misconfiguration, significantly limiting the attack surface (GitHub Advisory, Feedly).

1. Identify target: Confirm the target Kubernetes cluster runs ingress-nginx with kubectl get pods --all-namespaces --selector app.kubernetes.io/name=ingress-nginx, and identify Ingresses using the auth-url annotation.
2. Verify misconfiguration: Confirm the ingress-nginx controller is configured with a default custom-errors backend (via controller command-line arguments or ConfigMap) that intercepts HTTP 401 or 403 errors, and that this backend does not correctly handle the X-Code HTTP header.
3. Attempt authentication failure: Send an HTTP request to an auth-url-protected Ingress endpoint with invalid or missing credentials, which would normally result in a 401 or 403 response from the authentication service.
4. Observe bypass: If the custom-errors backend ignores the X-Code header and returns a non-blocking response, ingress-nginx fails to enforce the authentication rejection, and the request is forwarded to the upstream backend despite failed authentication.
5. Access protected resource: The attacker gains access to the protected resource without valid credentials (Kubernetes Issue, GitHub Advisory).

• Logs: Ingress-nginx access logs showing successful (2xx) responses to requests on auth-url-protected Ingress paths from users who failed authentication (i.e., the auth service returned 401/403 but the request was still proxied upstream).
• Network: Unexpected traffic reaching upstream backend services on paths that should be gated by external authentication, particularly from low-privilege or unauthenticated sources.
• Configuration: Presence of a non-default custom-errors backend configured in the ingress-nginx controller arguments or ConfigMap (--default-backend-service or custom-http-errors including 401 or 403) pointing to an external service rather than the built-in backend.

Upgrade ingress-nginx to version 1.13.7 or 1.14.3 (or later) to remediate the vulnerability. Prior to upgrading, administrators should audit their custom-errors backend to confirm it correctly reads and respects the X-Code HTTP header when handling 401 and 403 errors. If using per-Ingress custom-errors annotations (rather than controller-level defaults), the deployment is not affected. Clusters not using the auth-url annotation are also not at risk (GitHub Advisory, Kubernetes Issue).

The vulnerability was coordinated and fixed by Tabitha Sable and Marco Ebert from the Kubernetes Security Response Committee, with the issue disclosed via the official Kubernetes security advisory channel and oss-security mailing list (Kubernetes Issue). Coverage appeared in CSO Online and Network World noting it as one of four new ingress-nginx vulnerabilities disclosed around the same time (CSO Online). Community discussion on Reddit and Mastodon was relatively muted given the low severity and narrow exploitation conditions. The runZero blog and Datadog Security Labs also covered the broader ingress-nginx vulnerability disclosure batch in context of the project's retirement announcement (runZero Blog, Datadog Security Labs).