A security issue was discovered in ingress-nginx where the protection afforded by the `auth-url` Ingress annotation may not be effective in the presence of a specific misconfiguration. If the ingress-nginx controller is configured with a default custom-errors configuration that includes HTTP errors 401 or 403, and if the configured default custom-errors backend is defective and fails to respect the X-Code HTTP header, then an Ingress with the `auth-url` annotation may be accessed even when authentication fails. Note that the built-in custom-errors backend works correctly. To trigger this issue requires an administrator to specifically configure ingress-nginx with a broken external component.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - A security issue was discovered in ingress-nginx where the protection afforded by the `auth-url` Ingress
    annotation may not be effective in the presence of a specific misconfiguration. If the ingress-nginx
    controller is configured with a default custom-errors configuration that includes HTTP errors 401 or 403,
    and if the configured default custom-errors backend is defective and fails to respect the X-Code HTTP
    header, then an Ingress with the `auth-url` annotation may be accessed even when authentication fails.
    Note that the built-in custom-errors backend works correctly. To trigger this issue requires an
    administrator to specifically configure ingress-nginx with a broken external component. (CVE-2026-24513)

The version of Ingress-NGINX controller installed on the remote host is prior to 1.13.7 or 1.14.3. It is, therefore, affected by multiple vulnerabilities:

  - A security issue was discovered in ingress-nginx where the `nginx.ingress.kubernetes.io/auth-method` Ingress     annotation can be used to inject configuration into nginx. This can lead to arbitrary code execution in the     context of the ingress-nginx controller, and disclosure of Secrets accessible to the controller. (CVE-2026-1580)

  - A security issue was discovered in ingress-nginx where the `rules.http.paths.path` Ingress field can be used to     inject configuration into nginx. This can lead to arbitrary code execution in the context of the ingress-nginx     controller, and disclosure of Secrets accessible to the controller. (CVE-2026-24512)

  - A security issue was discovered in ingress-nginx where the protection afforded by the `auth-url` Ingress     annotation may not be effective in the presence of a specific misconfiguration. (CVE-2026-24513)

  - A security issue was discovered in ingress-nginx where the validating admission controller feature is subject to a     denial of service condition. By sending large requests to the validating admission controller, an attacker can     cause memory consumption, which may result in the ingress-nginx controller pod being killed or the node running     out of memory. (CVE-2026-24514)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
437555	SCA: security update for k8s.io/ingress-nginx (GHSA-4g2f-xcph-2335)	Tenable Cloud Security	SCA Checks	low
437555	SCA: security update for k8s.io/ingress-nginx (GHSA-4g2f-xcph-2335)	Tenable Self-Hosted Container Security	SCA Checks	low
297852	Ingress-NGINX Controller < 1.13.7 / 1.14.x < 1.14.3 Multiple Vulnerabilities	Nessus	Misc.	high

Detections

Analytics

CVE-2026-24513

low

Tenable Plugins

low

low

high