17. 升级 Ingress-Nginx CVEs - CVE-2025-15566, CVE-2026-1580, CVE-2026-24512, CVE-2026-24513, and C

IT干货

505人浏览 · 2026-02-24 11:52:49

IT干货 · 2026-02-24 11:52:49 发布

环境

A Rancher-provisioned or standalone RKE2 cluster with the ingress-nginx Ingress controller.
一个由 Rancher 配置的或独立的 RKE2 集群，带有 ingress-nginx 的入口控制器。
ingress-nginx versions:
Ingress-NGINX 版本：
- < v1.13.7
- v1.14.x < v1.14.3
RKE2 versions (affected):
RKE2 版本（受影响）：
- <= v1.32.11+rke2r1
- v1.33 <= v1.33.7+rke2r1
- v1.34 <= v1.34.3+rke2r1
- v1.35.0+rke2r1

情况

The upstream Kubernetes project announced, on February 1st and 5th of 2026, multiple security vulnerabilities affecting the ingress-nginx component:
上游 Kubernetes 项目于 2026 年 2 月 1 日和 5 日宣布了影响 ingress-nginx 组件的多项安全漏洞：

If a cluster is not running ingress-nginx - for example, if it is running the Traefik Ingress controller instead - it is unaffected. You can verify the presence of the RKE2 ingress-nginx instance using the following command:
如果集群没有运行 ingress-nginx——例如，如果它运行的是 Traefik Ingress 控制器——则不受影响。您可以使用以下命令验证 RKE2 ingress-nginx 实例的存在：

<span style="color:#000000"><span style="background-color:#ffffff"><span style="background-color:#efefef"><code>kubectl get pods --all-namespaces --selector <a data-cke-saved-href="http://app.kubernetes.io/name=rke2-ingress-nginx" href="http://app.kubernetes.io/name=rke2-ingress-nginx">app.kubernetes.io/name=rke2-ingress-nginx</a></code></span></span></span>

Note: K3s clusters utilize the Traefik Ingress controller by default and are not affected by these ingress-nginx issues unless you have manually deployed a custom instance of ingress-nginx.
注： K3s 集群默认使用 Traefik Ingress 控制器，除非你手动部署了自定义的 ingress-nginx 实例，否则不会受到这些 ingress-nginx 问题的影响。

解决方案

Upgrade RKE2 升级 RKE2

The primary resolution is to upgrade to an RKE2 patch release containing the ingress-nginx fixes. Upgrade to one of the following versions (or later), which package a patched version of ingress-nginx:
主要解决方案是升级到包含 ingress-nginx 修复的 RKE2 补丁版本。升级到以下版本之一（或更高版本），这些版本包含了 ingress-nginx 的补丁版本：

Workarounds 变通方法

If you are unable to upgrade your RKE2 version immediately, consider the following mitigation steps:
如果您无法立即升级 RKE2 版本，请考虑以下缓解措施：

CVE-2025-15566: Use a validating admission controller to reject Ingress resources containing the nginx.ingress.kubernetes.io/auth-proxy-set-headers annotation.
CVE-2025-15566： 使用验证准入控制器拒绝包含该 nginx.ingress.kubernetes.io/auth-proxy-set-headers 注释的 Ingress 资源。
CVE-2026-1580: Use a validating admission controller to reject Ingress resources containing the nginx.ingress.kubernetes.io/auth-method annotation.
CVE-2026-1580： 使用验证准入控制器拒绝包含该 nginx.ingress.kubernetes.io/auth-method 注释的 Ingress 资源。
CVE-2026-24512: Use a validating admission controller to reject Ingress resources with the ImplementationSpecific path type.
CVE-2026-24512： 使用验证准入控制器拒绝带有 ImplementationSpecific 路径类型的 Ingress 资源。
CVE-2026-24513: Verify that any custom errors backend (if configured) correctly respects and validates the X-Code HTTP header.
CVE-2026-24513： 验证任何自定义错误后端（如果已配置）是否正确尊重并验证 X-Code HTTP 头。
CVE-2026-24514: No mitigation is available for this specific vulnerability. An upgrade to a patched version is required.
CVE-2026-24514： 目前无法针对该漏洞采取任何缓解措施。需要升级到已打补丁的版本。

原因

Multiple security issues were discovered in the ingress-nginx controller that could allow an attacker to bypass security controls or execute arbitrary code. The vulnerabilities are categorized as follows:
在 ingress-nginx 控制器中发现了多项安全问题，可能允许攻击者绕过安全控制或执行任意代码。漏洞分类如下：

Configuration Injection (CVE-2025-15566, CVE-2026-1580, CVE-2026-24512): Improper validation of the auth-proxy-set-headers and auth-method annotations, and handling of ImplementationSpecific path types, allows an attacker to inject configuration into the generated nginx configuration. This can lead to arbitrary code execution, and disclosure of Kubernetes Secrets accessible to the controller. Note: In default installations, the ingress-nginx controller has permissions to access all Secrets cluster-wide.
配置注入（CVE-2025-15566，CVE-2026-1580，CVE-2026-24512）： 对 auth-proxy-set-headers 和 author-method 注释的不当验证，以及对 ImplementationSpecific 路径类型的处理，使攻击者能够向生成的 nginx 配置注入配置。这可能导致任意代码执行，以及控制器可访问的 Kubernetes 秘密泄露。注：在默认安装中，ingress-nginx 控制器拥有访问所有集群级 Secret 的权限。
Authentication Bypass (CVE-2026-24513): Insufficient validation of the X-Code header when using a custom error backend could allow an Ingress with the auth-url annotation to be accessed even when authentication fails.
认证绕过（CVE-2026-24513）： 使用自定义错误后端时，X-Code 头部验证不足，即使认证失败，也可能访问带有 auth-url 注释的 Ingress。
Denial of Service (CVE-2026-24514): A vulnerability in the controller's internal processing, could lead to OOM events for ingress-nginx controller Pods or Nodes, as a result of large requests sent to the ingress-nginx validating admission controller.
拒绝服务（CVE-2026-24514）： 控制器内部处理中的漏洞可能导致入口-nginx 控制器 Pods 或节点的 OOM 事件，原因是向 ingress-nginx 验证准入控制器发送大量请求。