---
id: CVE-2026-116472
title: ingress-nginx mirror-target self-DOS
summary: >-
  A security issue was discovered in ingress-nginx where a user with permission
  to create an Ingress may be able to cause denial of service of the
  ingress-nginx data plane, or possibly redirect traffic from other Ingresses.
  Kubernetes clus…
severity: low
cvss: 2.7
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L'
cvssSource: cna
cwe:
  - CWE-20
vendor: Kubernetes
product: ingress-nginx
affected:
  - ingress-nginx < *
  - rancher_prime_rke2_ingress-nginx < 1.15.2-prime1
published: '2026-11-05'
updated: '2026-11-05'
sourceUpdated: '2026-11-05T22:05:45.488Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-116472'
references:
  - url: 'https://github.com/kubernetes/kubernetes/issues/143852'
tags:
  - cve.org
ingestedAt: '2026-11-05T23:41:31.956Z'
epss: 0.00411
epssPercentile: 0.35644
---

## Overview

A security issue was discovered in ingress-nginx where a user with permission to create an Ingress may be able to cause denial of service of the ingress-nginx data plane, or possibly redirect traffic from other Ingresses. Kubernetes clusters are only affected if they are using ingress-nginx.

Due to a missing check, the mirror-target Ingress annotation can be used to target an unauthenticated configuration API within the ingress-nginx controller, allowing write commands to be submitted. Corrupting the data within that configuration API results in all traffic through ingress-nginx being dropped until an Ingress configuration change or a controller restart causes the data to be recreated correctly.

In principle, this write access could also be used to redirect traffic from other Ingresses controlled by the same ingress-nginx instance. In practice, there is negligible additional risk: such redirection would require privileged information about internal ingress-nginx state, and users can already redirect traffic from other Ingresses controlled by the same ingress-nginx anyway.

## Affected

- `ingress-nginx < *`
- `rancher_prime_rke2_ingress-nginx < 1.15.2-prime1`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.