Notice of the NGINX Ingress Controller Vulnerability (CVE-2026-42533)

Description

Impact

This vulnerability affects the open-source NGINX Ingress Controller of the following versions:

• ≤ v1.13.9
• ≤ v1.14.5
• ≤ v1.15.1

This vulnerability affects the CCE NGINX Ingress Controller add-on 5.0.17, 6.0.33, and earlier. Refer to NGINX Ingress Controller Release History for the details about the mapping between the CCE NGINX Ingress Controller add-on and open-source versions.

Identification Method

1. Go to Add-ons and check whether the NGINX Ingress Controller add-on has been installed and its version.
   Figure 1 Viewing the installed add-on version
   

2. If the add-on version is 5.0.17, 6.0.33, or earlier, the add-on is affected by this vulnerability. In this case, go to 3. If the add-on version is not 5.0.17, 6.0.33, or earlier, it is not affected by this vulnerability.
3. Check the Nginx configuration in the pods for running the CCE NGINX Ingress Controller add-on.

   Run the following command to view the pods of the installed CCE NGINX Ingress Controller add-on:

   kubectl get po -A|grep cceaddon-nginx-ingress|grep controller

   As shown in the figure, two Nginx Ingress Controllers have been installed in the cluster.

   

   View the rewrite configuration in the nginx.conf file.

   # 1. Access the Nginx Ingress Controller pod.
   kubectl exec -it -n <ingress-namespace> <cceaddon-nginx-ingress-controller-pod-name> -- /bin/bash  
   
   # 2. Check whether the nginx.conf file contains suspicious map configurations and rewrite rule combinations.
   # Pay special attention to the map directive that uses regular expression matching and the rewrite or set directive that references capture groups such as $1 and $2.
   cat /etc/nginx/nginx.conf | grep -E "map.*~|rewrite.*\$[0-9]|set.*\$[0-9]"

   A vulnerability may be triggered if the output Nginx rewrite configuration:

   1. Includes the map instruction (using ~ for regular expression matching).
   2. Includes the rewrite or set directive that references unnamed capture groups, such as $1 and $2.

Mitigation

Before fixing this vulnerability, grant only the permissions for creating and managing ingresses to trusted users based on the principle of least privilege. For details, see Namespace Permissions (Kubernetes RBAC-based).

If the check result shows that the vulnerability triggering conditions are met, you can harden the ingress configuration by performing the following operations:

1. Check the ingress configuration.

   kubectl get ingress -A -o yaml | grep -A 5 -B 5 "nginx.ingress.kubernetes.io/rewrite-target"
   kubectl get ingress -A -o yaml | grep -A 5 -B 5 "nginx.ingress.kubernetes.io/configuration-snippet"

2. Use named captures.
   Replace unnamed captures (such as $1 and $2) in the dangerous rewrite and set directive combinations in all configurations with named captures (such as (?<name>...)).

   apiVersion: networking.k8s.io/v1
   kind: Ingress
   metadata:
     name: safe-ingress
     annotations:
       # Use the named capture $path and retain the question mark (the named capture can mitigate the vulnerability).
       nginx.ingress.kubernetes.io/rewrite-target: /new-path/$path?
       nginx.ingress.kubernetes.io/configuration-snippet: |
         set $my_var $uri;   # Subsequent directives still exist, but the vulnerability is mitigated because a named capture is used.
   spec:
     rules:
     - host: example.com
       http:
         paths:
         - path: /old/(?<path>.*)   # Define the path of the named capture.
           pathType: Prefix
           backend:
             service:
               name: backend-svc
               port:
                 number: 80

3. Modify nginx.ingress.kubernetes.io/configuration-snippet in the annotation of the ingress by referring to step 2.

Solution

CCE will release a new version of the NGINX Ingress Controller add-on that addresses this vulnerability. Keep an eye out for NGINX Ingress Controller Release History.

Helpful Links

Official Nginx security advisories: https://nginx.org/en/security_advisories.html