CVE-2025-15566

A security issue was discovered in ingress-nginx where the `nginx.ingress.kubernetes.io/auth-proxy-set-headers` Ingress annotation can be used to inject configuration into nginx. This can lead to arbitrary code execution in the context of the ingress-nginx controller, and disclosure of Secrets accessible to the controller. (Note that in the default installation, the controller can access all Secrets cluster-wide.)

• CWE-20

• https://github.com/kubernetes/kubernetes/issues/136789

Published

Feb 6, 2026

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-15560An authenticated attacker with minimal permissions can explo…8.8
• CVE-2025-15561An attacker can exploit the update behavior of the WorkTime …7.8
• CVE-2025-15562The server API endpoint /report/internet/urls reflects recei…6.1
• CVE-2025-15563Any unauthenticated user can reset the WorkTime on-prem data…5.3
• CVE-2025-15564A vulnerability has been found in Mapnik up to 4.2.0. This v…5.5
• CVE-2025-15565The Nexi XPay plugin for WordPress is vulnerable to unauthor…5.3
• CVE-2025-15567Insufficient protection mechanisms in the Health Module may …3.3
• CVE-2025-15568A command injection vulnerability was identified in the web …8
• CVE-2025-15569A flaw has been found in Artifex MuPDF up to 1.26.1 on Windo…7.3
• CVE-2025-1557A vulnerability, which was classified as problematic, was fo…5.3
• CVE-2025-15570A vulnerability was found in ckolivas lrzip up to 0.651. Thi…7.8
• CVE-2025-15571A security vulnerability has been detected in ckolivas lrzip…5.5