{"id":"CVE-2026-116472","title":"ingress-nginx mirror-target self-DOS","summary":"A security issue was discovered in ingress-nginx where a user with permission to create an Ingress may be able to cause denial of service of the ingress-nginx data plane, or possibly redirect traffic from other Ingresses. Kubernetes clus…","severity":"low","cvss":2.7,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L","cvssSource":"cna","cwe":["CWE-20"],"vendor":"Kubernetes","product":"ingress-nginx","affected":["ingress-nginx < *","rancher_prime_rke2_ingress-nginx < 1.15.2-prime1"],"published":"2026-11-05","updated":"2026-11-05","sourceUpdated":"2026-11-05T22:05:45.488Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-116472","references":[{"url":"https://github.com/kubernetes/kubernetes/issues/143852"}],"tags":["cve.org"],"ingestedAt":"2026-11-05T23:41:31.956Z","epss":0.00411,"epssPercentile":0.35644,"slug":"CVE-2026-116472","body":"## Overview\n\nA security issue was discovered in ingress-nginx where a user with permission to create an Ingress may be able to cause denial of service of the ingress-nginx data plane, or possibly redirect traffic from other Ingresses. Kubernetes clusters are only affected if they are using ingress-nginx.\n\nDue to a missing check, the mirror-target Ingress annotation can be used to target an unauthenticated configuration API within the ingress-nginx controller, allowing write commands to be submitted. Corrupting the data within that configuration API results in all traffic through ingress-nginx being dropped until an Ingress configuration change or a controller restart causes the data to be recreated correctly.\n\nIn principle, this write access could also be used to redirect traffic from other Ingresses controlled by the same ingress-nginx instance. In practice, there is negligible additional risk: such redirection would require privileged information about internal ingress-nginx state, and users can already redirect traffic from other Ingresses controlled by the same ingress-nginx anyway.\n\n## Affected\n\n- `ingress-nginx < *`\n- `rancher_prime_rke2_ingress-nginx < 1.15.2-prime1`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":15,"depthScoreParts":{"impact":14.9,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}