HIGH 8.8 Go
ingress-nginx's `rules.http.paths.path` Ingress field can be used to inject configuration into nginx
GHSA-jx8c-56mg-h6vp · CVE-2026-24512 · GO-2026-4426
Published · Modified
AI SAST
Find this class of vulnerability in your own code
Corgea's AI-native static analysis detects vulnerabilities like this one across your repositories, ranks them by exploitability, and returns review-ready fixes.
Description
A security issue was discovered in ingress-nginx. Tthe rules.http.paths.path Ingress field can be used to inject configuration into nginx. This can lead to arbitrary code execution in the context of the ingress-nginx controller, and disclosure of Secrets accessible to the controller. (Note that in the default installation, the controller can access all Secrets cluster-wide.)
Ready to move
Start Securing
Free, no credit card | First findings in minutes