GHSA-4g2f-xcph-2335

A security issue was discovered in ingress-nginx where the protection afforded by the auth-url Ingress annotation may not be effective in the presence of a specific misconfiguration.

If the ingress-nginx controller is configured with a default custom-errors configuration that includes HTTP errors 401 or 403, and if the configured default custom-errors backend is defective and fails to respect the X-Code HTTP header, then an Ingress with the auth-url annotation may be accessed even when authentication fails.

Note that the built-in custom-errors backend works correctly. Triggering this issue requires an administrator to specifically configure ingress-nginx with a broken external component.

Database specific

{
    "nvd_published_at": "2026-02-03T23:16:07Z",
    "github_reviewed": true,
    "cwe_ids": [
        "CWE-754"
    ],
    "github_reviewed_at": "2026-02-04T20:05:31Z",
    "severity": "LOW"
}

References

Affected packages

Go / k8s.io/ingress-nginx

Package

Name: k8s.io/ingress-nginx; View open source insights on deps.dev
Purl: pkg:golang/k8s.io/ingress-nginx

Affected ranges

Type: SEMVER
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.13.7

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/02/GHSA-4g2f-xcph-2335/GHSA-4g2f-xcph-2335.json"

Go / k8s.io/ingress-nginx

Package

Name: k8s.io/ingress-nginx; View open source insights on deps.dev
Purl: pkg:golang/k8s.io/ingress-nginx

Affected ranges

Type: SEMVER
Events: Introduced

1.14.0

Fixed

1.14.3

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/02/GHSA-4g2f-xcph-2335/GHSA-4g2f-xcph-2335.json"