Vulnerabilities have been discovered in the Ingress-Nginx Kubernetes gatekeeper platform ahead of its planned obsolescence.

In a message from the Kubernetes Security Response Committee (SRC), users were alerted to four issues affecting the Ingress controller, a specialized load balancer and reverse proxy for Kubernetes clusters that manages traffic management, security, and load balancing from a single entry point. Acting as an Nginx-based gatekeeper, Ingress-Nginx manages external access to services within the cluster using advanced routing rules.

Most of the reported issues, including CVE-2026-24512 and CVE-2026-24514, affect how the controller parses and applies user-supplied ingress configuration or HTTP request data, potentially exposing the controller to unsafe configuration handling, request validation issues, or broader control-plane risks if left unpatched. Of the three, CVE-2026-24513 had the most pressing security rating with a "high" ranking of CVSS 8.8.

Another issue (CVE-2026-1580) specifically impacts HTTP request processing and input validation at runtime.

Users were advised to upgrade Ingress-Nginx to v1.13.7, v1.14.3, or any later version, while a reminder on GitHub that maintenance for the controller will cease in March of this year.

The decision was ultimately made by the Kubernetes SRC to retire the tool in light of a cluster of remote code execution (RCE) vulnerabilities discovered last year, as evolving expectations for cloud-native software, turning formerly useful features into potential security vulnerabilities.

Michael Clark, senior director of Threat Research at Sysdig, commented that there was no direct path from the latest flaws to pose an RCE-based threat, but that users should still ditch the controller sooner rather than later.

"The new issues disclosed stem from configuration injection and path-handling flaws in the Ingress-Nginx controller that could lead to code execution within the controller's own context," Clark told SDxCentral. "They are not a simple, open-ended RCE by default. Exploitation generally requires existing permissions, such as the ability to create or modify Ingress resources targeting an Ingress-Nginx controller, and in some cases may result only in denial-of-service or limited secret exposure unless combined with additional vulnerabilities."

Clark added: "Organizations should promptly upgrade to patched, trusted Ingress-Nginx releases, ensure admission webhooks are not publicly exposed, and continue monitoring the Kubernetes Security Response Committee's advisories while validating ingress controller versions across all environments."