The ingress-nginx is a Kubernetes Ingress controller that uses NGINX as a reverse proxy and load balancer. On February 2, 2026, the Kubernetes community disclosed the security vulnerability CVE-2026-1580 in ingress-nginx.

Vulnerability severity

The CVE-2026-1580 vulnerability is rated as a high-risk vulnerability with a CVSS score of 8.8.

Scope of impact

This vulnerability affects ingress-nginx that meets the following condition:

Ingress-nginx < v1.14.3

Remediation

VKE has released a patched version of ingress-nginx-controller that fixes CVE-2026-1580. For details, see ingress-nginx release notes. Before upgrading the ingress-nginx add-on, read and assess the change impact to prevent potential traffic disruption.

The newly released ingress-nginx-controller version only supports Kubernetes v1.26 and later. If the Kubernetes version of the cluster is lower than v1.26, first upgrade the cluster.

Reference

Vulnerability issue:

CVE-2026-1580

Last updated: 2026.07.15 15:51:31

Public security network record in Beijing: No. 11010802032137