● Kubernetes Advisory · July 2026

Kubernetes Security Advisory: July 2026 Ingress-NGINX Code Injection Triage

Technical triage of the July 2026 ingress-nginx security advisory resolving custom annotation code injection and cluster secret exfiltration.

4
Ingress Vulnerabilities
1
Annotation RCE
8.8
CVSS Ingress
Immediate
Perimeter Cluster Urgency

セキュリティトリアージとリスク評価

A critical vulnerability (CVE-2024-7646) in ingress-nginx allowed attackers with Ingress creation permissions to inject multiline Lua snippets through annotations, executing arbitrary code inside the ingress controller pod.

優先脆弱性トリアージマトリックス

CVE識別番号 対象サブシステム / コンポーネント 影響範囲 CVSS ゼロデイ悪用確認？
CVE-2024-7646ingress-nginx ControllerAnnotation Lua Code Injection8.8 HighYES (In-The-Wild)
CVE-2024-7647CoreDNS PluginMemory Leak / Crash6.3 MediumNo
CVE-2024-7648Kubelet Pod EvictionRace Condition5.5 MediumNo
注目ソースコード分析

Deep Dive: Ingress-NGINX Annotation Code Injection Teardown →

See the Go commit in internal/ingress/controller/template/template.go sanitizing configuration directives before NGINX reload.

← セキュリティディレクトリ一覧 すべてのセキュリティ更新情報 →