CVE-2026-24514: 
Ingress NGINX Controller (community-driven) vulnerability analysis and mitigation

CVE-2026-24514 is a denial-of-service vulnerability in the Kubernetes ingress-nginx validating admission controller, classified as "Allocation of Resources Without Limits or Throttling" (CWE-770). By sending oversized requests to the admission controller endpoint, a low-privileged attacker can trigger excessive memory consumption, potentially crashing the ingress-nginx controller pod or exhausting node memory. Affected versions are ingress-nginx < 1.13.7 and >= 1.14.0, < 1.14.3. It was disclosed on February 2–4, 2026, with a CVSS v3.1 base score of 6.5 (Medium) (GitHub Advisory, Kubernetes Issue).

The root cause is CWE-770 — the ingress-nginx validating admission controller does not impose limits on the size of incoming requests, allowing unbounded memory allocation. An attacker with low-level network access can craft and send large HTTP requests directly to the admission controller webhook endpoint, causing the controller process to allocate memory without restriction until the pod is OOM-killed or the underlying node exhausts available memory. No authentication bypass is required beyond the low-privilege precondition; the admission controller must be reachable by the attacker. A public proof-of-concept exploit is available (PoC GitHub, GitHub Advisory).

Successful exploitation results in a high availability impact: the ingress-nginx controller pod may be killed due to out-of-memory conditions, or the Kubernetes node itself may run out of memory, disrupting all services dependent on the ingress controller. There is no confidentiality or integrity impact — the attack is purely a denial-of-service. In environments where ingress-nginx is the sole ingress controller, this could render all ingress-routed services unreachable until the pod restarts or the node recovers (Kubernetes Issue, GitHub Advisory).

A public proof-of-concept exploit targeting this vulnerability is available on GitHub (PoC GitHub). As of the time of reporting, there is no confirmed evidence of in-the-wild exploitation. The EPSS score is approximately 0.039% (12th percentile), indicating a currently low probability of exploitation in the next 30 days. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires only low privileges and network access to the admission controller endpoint (GitHub Advisory).

1. Reconnaissance: Identify Kubernetes clusters running ingress-nginx versions < 1.13.7 or between 1.14.0 and < 1.14.3 using kubectl get pods --all-namespaces --selector app.kubernetes.io/name=ingress-nginx or by scanning for exposed admission controller webhook endpoints.
2. Locate the admission controller endpoint: Determine the address and port of the ingress-nginx validating admission controller webhook service within the cluster (typically accessible from within the cluster network or via misconfigured exposure).
3. Craft a large request: Prepare an oversized HTTP POST request (several megabytes or larger) targeting the admission controller webhook endpoint, simulating a large Ingress resource admission review payload.
4. Send the request: Transmit the large request to the admission controller endpoint using tools such as curl, python, or a custom script. Repeat as needed to sustain memory pressure.
5. Trigger OOM condition: The controller process allocates memory without limits to process the request, eventually causing the pod to be OOM-killed by Kubernetes or exhausting node memory, resulting in service disruption (Kubernetes Issue, PoC GitHub).

• Network: Unusually large HTTP POST requests (several megabytes or more) directed at the ingress-nginx admission controller webhook endpoint; repeated requests from the same source IP to the admission controller service.
• Logs: Kubernetes events showing OOMKilled status for the ingress-nginx controller pod; admission controller logs showing processing of abnormally large payloads.
• Process/Resource: Rapid memory growth in the ingress-nginx controller container visible via kubectl top pods; repeated pod restarts with OOMKilled exit reason (kubectl describe pod <ingress-nginx-pod>).
• Cluster Events: Kubernetes node-level memory pressure events or node NotReady conditions following repeated large admission requests (Kubernetes Issue).

Upgrade ingress-nginx to version 1.13.7 or 1.14.3 (or any later release) to remediate this vulnerability. As a workaround prior to patching, implement network-level controls to restrict access to the validating admission controller webhook endpoint to only trusted sources (e.g., the Kubernetes API server), and consider configuring request size limits or rate limiting at the network or load balancer layer. Monitor ingress-nginx pod memory consumption for anomalies and set appropriate resource limits and pod disruption budgets to reduce impact. Clusters without ingress-nginx installed are not affected (GitHub Advisory, Kubernetes Issue).

The vulnerability was part of a broader set of ingress-nginx security issues disclosed in early February 2026, covered by CSO Online and Network World under the headline "Four new vulnerabilities found in ingress-nginx" (CSO Online, Network World). The Kubernetes Security Response Committee coordinated disclosure and credited researcher Matan Shabtay for discovery (Kubernetes Issue). Datadog Security Labs and runZero also published analysis in the context of broader ingress-nginx security and retirement discussions (runZero Blog, Datadog Security Labs). The Belgium Centre for Cybersecurity and INCIBE also issued advisories referencing this CVE.