{"id":"CVE-2026-24513","aliases":["GHSA-4g2f-xcph-2335","GO-2026-4419"],"title":"ingress-nginx has Improper Check for Unusual or Exceptional Conditions","summary":"ingress-nginx has Improper Check for Unusual or Exceptional Conditions","severity":"low","cvss":3.1,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N","vendor":"ingress-nginx","product":"k8s.io/ingress-nginx","ecosystem":"go","affected":["k8s.io/ingress-nginx < 1.13.7","k8s.io/ingress-nginx >= 1.14.0, < 1.14.3"],"patched":["k8s.io/ingress-nginx 1.13.7","k8s.io/ingress-nginx 1.14.3"],"published":"2026-02-04","updated":"2026-09-10","sourceUpdated":"2026-09-10T03:50:34.015338542Z","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-4g2f-xcph-2335","references":[{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-24513"},{"url":"https://github.com/kubernetes/kubernetes/issues/136679"},{"url":"https://github.com/kubernetes/ingress-nginx"}],"tags":["osv","go"],"epss":0.00319,"epssPercentile":0.25083,"ingestedAt":"2026-09-12T03:13:01.752Z","slug":"CVE-2026-24513","body":"## Overview\n\nA security issue was discovered in ingress-nginx where the protection afforded by the `auth-url` Ingress annotation may not be effective in the presence of a specific misconfiguration.\n\nIf the ingress-nginx controller is configured with a default custom-errors configuration that includes HTTP errors 401 or 403, and if the configured default custom-errors backend is defective and fails to respect the X-Code HTTP header, then an Ingress with the `auth-url` annotation may be accessed even when authentication fails.\n\nNote that the built-in custom-errors backend works correctly. Triggering this issue requires an administrator to specifically configure ingress-nginx with a broken external component.\n\n## Affected packages\n\n- `k8s.io/ingress-nginx < 1.13.7`\n- `k8s.io/ingress-nginx >= 1.14.0, < 1.14.3`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `k8s.io/ingress-nginx 1.13.7`\n- `k8s.io/ingress-nginx 1.14.3`","depth":"sunlit","depthScore":17,"depthScoreParts":{"impact":17.1,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}