CVE-2026-1580

A security issue was discovered in ingress-nginx where the `nginx.ingress.kubernetes.io/auth-method` Ingress annotation can be used to inject configuration into nginx. This can lead to arbitrary code execution in the context of the ingress-nginx controller, and disclosure of Secrets accessible to the controller. (Note that in the default installation, the controller can access all Secrets cluster-wide.)

• CWE-20

• https://github.com/kubernetes/kubernetes/issues/136677

Published

Feb 3, 2026

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-1579The MAVLink communication protocol does not require cryptogr…9.8
• CVE-2026-15791A crafted message in the BuildKit low-level build API can be…7.5
• CVE-2026-15792A malicious BuildKit client or frontend could craft a reques…7.5
• CVE-2026-15793BuildKit custom frontends or clients using the raw low-level…7.5
• CVE-2026-15794The Grid/List View for WooCommerce plugin for WordPress is v…6.4
• CVE-2026-15799Rejected reason: This is a duplicate.
• CVE-2026-15802The WP Foodbakery plugin for WordPress is vulnerable to arbi…8.1
• CVE-2026-15803In Eclipse RDF4J, several XML parser entry points do not ful…8.7
• CVE-2026-15804The HCM developed by MetaGuru has a SQL Injection vulnerabil…8.8
• CVE-2026-15805Rejected reason: This CVE ID has been rejected or withdrawn …
• CVE-2026-15809A flaw was found in CRI-O. The fix for a previous vulnerabil…7.8
• CVE-2026-1581The wpForo Forum plugin for WordPress is vulnerable to time-…7.5