ingress-nginx: Denial of service and traffic redirection (CVE-2026-116472)
A security issue in ingress-nginx allows users with permission to create an Ingress to cause a denial of service of the ingress-nginx data plane or potentially redirect traffic from other Ingresses. Kubernetes clusters are only affected if using ingress-nginx.
CVE search metadata
CVE search record: CVE-2026-116472. Severity: low. CVSS: 2.7. KEV: no. Product: ingress-nginx. Brief: ingress-nginx: Denial of service and traffic redirection (CVE-2026-116472). Brief link: https://feed.craftedsignal.io/briefs/2026-11-ingress-nginx-mirror-target-dos/
Triage facts
Revision 1- Applicability
- ingress-nginx
- Evidence
- Unknown
- Severity
- Low
- Sources
- 1 public source
- Freshness
- Revision 1Nov 5, 20:26 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- D3Roughly even chance
A security issue was discovered in ingress-nginx. A user with permission to create an Ingress may be able to cause a denial of service of the ingress-nginx data plane or potentially redirect traffic from other Ingresses. Kubernetes will not be issuing a fix for this CVE because ingress-nginx maintenance ended in March 2026.