CVE-2026-24513 ingress-nginx auth-url protection bypass
Attackers can bypass authentication in ingress-nginx if a custom error backend ignores the X-Code header, requiring specific non-default configuration.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-24513?
CVE-2026-24513 is a low-severity authentication bypass vulnerability in Kubernetes ingress-nginx, published on 3 Feb 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
A security issue was discovered in ingress-nginx where the protection afforded by the `auth-url` Ingress annotation may not be effective in the presence of a specific misconfiguration.
If the ingress-nginx controller is configured with a default custom-errors configuration that includes HTTP errors 401 or 403, and if the configured default custom-errors backend is defective and fails to respect the X-Code HTTP header, then an Ingress with the `auth-url` annotation may be accessed even when authentication fails.
Note that the built-in custom-errors backend works correctly. To trigger this issue requires an administrator to specifically configure ingress-nginx with a broken external component.
Weakness: CWE-754
Which versions are affected by CVE-2026-24513?
5 open source packages ship an affected version, including k8s.io/ingress-nginx.
| Package | Affected | Fixed in |
|---|---|---|
k8s.io/ingress-nginx Go | All versions | None |
k8s.io/ingress-nginx Go | All versions | 1.13.7 |
k8s.io/ingress-nginx Go | All versions | 1.13.7 |
k8s.io/ingress-nginx Go | From 1.14.0 | 1.14.3 |
k8s.io/ingress-nginx Go | From 1.14.0 | 1.14.3 |
How do I fix CVE-2026-24513?
Upgrade k8s.io/ingress-nginx to a fixed version for your release line: 1.13.7 or 1.14.3.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2026-24513 being exploited?
There is no known exploitation of CVE-2026-24513 in the wild and no public exploit code.
Sources
Also known as GHSA-4g2f-xcph-2335, GO-2026-4419, MINI-295q-hc5x-vvr3, MINI-2jv5-fcfc-jp92, MINI-4c88-ppm7-gh6w, MINI-5ggr-c74h-p5x2 and 6 more.