CVE-2026-3288: 
Ingress NGINX Controller (community-driven) vulnerability analysis and mitigation

CVE-2026-3288 is a configuration injection vulnerability in the Kubernetes ingress-nginx controller, where the nginx.ingress.kubernetes.io/rewrite-target Ingress annotation can be abused to inject arbitrary nginx configuration directives. This can lead to remote code execution (RCE) in the context of the ingress-nginx controller process and disclosure of Kubernetes Secrets accessible to the controller — which in default installations includes all Secrets cluster-wide. The vulnerability was disclosed on March 9, 2026, and reported by Kai Aizen (Kubernetes Issue, oss-security). Affected versions are ingress-nginx < 1.13.8, < 1.14.4, and < 1.15.0. It carries a CVSS v3.1 base score of 8.8 (HIGH) (Kubernetes Issue).

The root cause is improper input validation (CWE-20) in the buildProxyPass() function, which interpolates the Ingress path field directly into nginx configuration without sanitizing special characters such as double quotes ("). An attacker can craft a path value containing a " character to break out of the quoted string context in the generated nginx configuration and inject arbitrary nginx directives (e.g., return, rewrite, set) (CVE-2026-3288 Lab). The attack vector is network-based, requires only low privileges (permission to create or modify Ingress resources in the cluster), and no user interaction. For example, a path value of /api" return 200 "HACKED would result in a malformed nginx config block that executes the injected directive instead of the intended proxy behavior (CVE-2026-3288 Lab, Kubernetes Issue).

Successful exploitation allows any authenticated Kubernetes user with permission to create or modify Ingress resources to execute arbitrary code as the ingress-nginx controller process and read all Kubernetes Secrets accessible to the controller — in default installations, this means all Secrets cluster-wide (Kubernetes Issue). Concrete attack scenarios include response hijacking, credential theft (e.g., reflecting Authorization headers), phishing redirects, internal IP disclosure, and session cookie theft (CVE-2026-3288 Lab). The combination of RCE and cluster-wide Secret access creates significant potential for lateral movement, privilege escalation, and full cluster compromise.

No confirmed in-the-wild exploitation has been reported as of the time of this report, and no functional exploit proof-of-concept (PoC) has been publicly confirmed — a GitHub repository (SnailSploit/CVE-2026-3288) was assessed as advisory documentation only, not a working exploit (Feedly). A separate lab environment (bvabhishek/CVE-2026-3288-lab) exists for authorized security training and demonstrates exploitation mechanics but is not a weaponized exploit (CVE-2026-3288 Lab). The EPSS score is approximately 0.04%, indicating low current exploitation probability. The vulnerability is not listed in the CISA KEV catalog at this time. Oracle included this CVE in its April 2026 Critical Patch Update (Oracle CPU Apr 2026).

1. Reconnaissance: Identify Kubernetes clusters running a vulnerable version of ingress-nginx (< 1.13.8, < 1.14.4, or < 1.15.0) using kubectl get pods --all-namespaces --selector app.kubernetes.io/name=ingress-nginx or by querying cluster metadata.
2. Obtain Ingress creation/modification permissions: Authenticate to the Kubernetes API with credentials that have RBAC permissions to create or modify Ingress resources in at least one namespace.
3. Craft a malicious Ingress resource: Create or modify an Ingress resource with a rules.http.paths.path value containing a double-quote injection payload. For example, set the path to /api" return 200 "INJECTED to break out of the nginx quoted string context.
4. Trigger nginx configuration reload: The ingress-nginx controller will process the malicious Ingress annotation and regenerate the nginx configuration, incorporating the injected directive.
5. Achieve code execution or data exfiltration: Depending on the injected directive, the attacker can execute arbitrary nginx directives (e.g., use set_by_lua or similar to achieve RCE), redirect traffic, or exfiltrate Kubernetes Secrets accessible to the controller process (CVE-2026-3288 Lab, Kubernetes Issue).

• Kubernetes API / Audit Logs: Unexpected creation or modification of Ingress resources by non-administrative users or service accounts; Ingress resources with unusual characters (especially ", \, or nginx directive keywords) in rules.http.paths.path fields.
• nginx Configuration: Presence of unexpected directives (e.g., return, rewrite, set, lua) injected into generated nginx configuration blocks; review with kubectl exec into the ingress-nginx pod and inspect /etc/nginx/nginx.conf.
• nginx Access/Error Logs: Unusual HTTP responses (e.g., unexpected 200/302 responses with attacker-controlled bodies), error messages related to nginx configuration parsing failures, or requests containing " characters in URL paths.
• Process Behavior: Unexpected child processes spawned by the ingress-nginx controller (e.g., shell commands, data exfiltration tools).
• Detection Query: Run kubectl get ingress --all-namespaces -o json | jq '.items[].spec.rules[].http.paths[].path' and inspect for suspicious characters or nginx directive keywords (Kubernetes Issue, CVE-2026-3288 Lab).

Upgrade ingress-nginx to a patched version: 1.13.8, 1.14.4, or 1.15.0 depending on your current release branch (oss-security). As a pre-upgrade workaround, use Kubernetes admission control (e.g., OPA/Gatekeeper or Kyverno) to block or restrict the use of the rewrite-target annotation on Ingress resources (Kubernetes Issue). Additionally, restrict RBAC permissions for creating and modifying Ingress resources to only trusted users and service accounts, implement network policies to limit the ingress-nginx controller's access to Secrets, and audit existing Ingress resources for suspicious rewrite-target or path annotations.

The vulnerability received broad coverage across security news outlets and community platforms shortly after disclosure on March 9, 2026, including write-ups on The Hacker Wire, SecurityOnline.info, and Cyfirma's weekly intelligence report (SecurityOnline, Cyfirma). The Canadian Centre for Cyber Security issued a Kubernetes security advisory (AV26-208) referencing the vulnerability (CCCS Advisory). Sysdig published a detection-focused blog post covering CVE-2026-3288 alongside the related CVE-2026-24512, providing guidance for Kubernetes defenders (Sysdig Blog). Community discussion was active on Hacker News, Reddit (r/devopsish), Bluesky, and Mastodon, with general consensus that the risk is significant for clusters with permissive Ingress RBAC.