CVE-2026-24512

A security issue was discovered in ingress-nginx where the `rules.http.paths.path` Ingress field can be used to inject configuration into nginx. This can lead to arbitrary code execution in the context of the ingress-nginx controller, and disclosure of Secrets accessible to the controller. (Note that in the default installation, the controller can access all Secrets cluster-wide.)

• CWE-20

• https://github.com/kubernetes/kubernetes/issues/136678

Published

Feb 3, 2026

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-24506Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.6,…7.2
• CVE-2026-24508Dell Alienware Command Center (AWCC), versions prior to 6.12…5.5
• CVE-2026-24509Dell Alienware Command Center (AWCC), versions prior to 6.12…5.5
• CVE-2026-2451Emails sent by pretix can utilize placeholders that will be …6.5
• CVE-2026-24510Dell Alienware Command Center (AWCC), versions prior to 6.12…7.8
• CVE-2026-24511Dell PowerScale OneFS, versions 9.5.0.0 through 9.10.1.6 and…4.4
• CVE-2026-24513A security issue was discovered in ingress-nginx where the p…3.1
• CVE-2026-24514A security issue was discovered in ingress-nginx where the v…6.5
• CVE-2026-24515In libexpat before 2.7.4, XML_ExternalEntityParserCreate doe…2.5
• CVE-2026-24516A command injection vulnerability exists in DigitalOcean Dro…8.8
• CVE-2026-24517An OS command injection vulnerability exists in XWEB Pro …7.2
• CVE-2026-2452Emails sent by pretix can utilize placeholders that will be …6.5