https://harvesterhci.io/assets/js/b40c47c2.0803baa2.js

1"use strict";(self.webpackChunkharvesterhci_io=self.webpackChunkharvesterhci_io||[]).push([[4120],{3905:function(e,t,n){n.d(t,{Zo:function(){return u},kt:function(){return h}});var i=n(7294);function a(e,t,n){return t in e?Object.defineProperty(e,t,{value:n,enumerable:!0,configurable:!0,writable:!0}):e[t]=n,e}function r(e,t){var n=Object.keys(e);if(Object.getOwnPropertySymbols){var i=Object.getOwnPropertySymbols(e);t&&(i=i.filter((function(t){return Object.getOwnPropertyDescriptor(e,t).enumerable}))),n.push.apply(n,i)}return n}function s(e){for(var t=1;t<arguments.length;t++){var n=null!=arguments[t]?arguments[t]:{};t%2?r(Object(n),!0).forEach((function(t){a(e,t,n[t])})):Object.getOwnPropertyDescriptors?Object.defineProperties(e,Object.getOwnPropertyDescriptors(n)):r(Object(n)).forEach((function(t){Object.defineProperty(e,t,Object.getOwnPropertyDescriptor(n,t))}))}return e}function o(e,t){if(null==e)return{};var n,i,a=function(e,t){if(null==e)return{};var n,i,a={},r=Object.keys(e);for(i=0;i<r.length;i++)n=r[i],t.indexOf(n)>=0||(a[n]=e[n]);return a}(e,t);if(Object.getOwnPropertySymbols){var r=Object.getOwnPropertySymbols(e);for(i=0;i<r.length;i++)n=r[i],t.indexOf(n)>=0||Object.prototype.propertyIsEnumerable.call(e,n)&&(a[n]=e[n])}return a}var l=i.createContext({}),p=function(e){var t=i.useContext(l),n=t;return e&&(n="function"==typeof e?e(t):s(s({},t),e)),n},u=function(e){var t=p(e.components);return i.createElement(l.Provider,{value:t},e.children)},c={inlineCode:"code",wrapper:function(e){var t=e.children;return i.createElement(i.Fragment,{},t)}},m=i.forwardRef((function(e,t){var n=e.components,a=e.mdxType,r=e.originalType,l=e.parentName,u=o(e,["components","mdxType","originalType","parentName"]),m=p(n),h=a,d=m["".concat(l,".").concat(h)]||m[h]||c[h]||r;return n?i.createElement(d,s(s({ref:t},u),{},{components:n})):i.createElement(d,s({ref:t},u))}));function h(e,t){var n=arguments,a=t&&t.mdxType;if("string"==typeof e||a){var r=n.length,s=new Array(r);s[0]=m;var o={};for(var l in t)hasOwnProperty.call(t,l)&&(o[l]=t[l]);o.originalType=e,o.mdxType="string"==typeof e?e:a,s[1]=o;for(var p=2;p<r;p++)s[p]=n[p];return i.createElement.apply(null,s)}return i.createElement.apply(null,n)}m.displayName="MDXCreateElement"},2074:function(e,t,n){n.r(t),n.d(t,{assets:function(){return u},contentTitle:function(){return l},default:function(){return h},frontMatter:function(){return o},metadata:function(){return p},toc:function(){return c}});var i=n(7462),a=n(3366),r=(n(7294),n(3905)),s=["components"],o={title:"Upstream Ingress-Nginx CVEs - CVE-2025-15566, CVE-2026-1580, CVE-2026-24512, CVE-2026-24513, and CVE-2026-24514",description:"This article provides information on the CVE-2025-15566, CVE-2026-1580, CVE-2026-24512, CVE-2026-24513, and CVE-2026-24514 vulnerabilities in Harvester.",authors:[{name:"Ivan Sim",title:"Principal Software Engineer",url:"https://github.com/ihcsim",image_url:"https://github.com/ihcsim.png"}],tags:["security","cve"],hide_table_of_contents:!1},l=void 0,p={permalink:"/kb/2026/02/23/nginx-ingress-cve",editUrl:"https://github.com/harvester/harvesterhci.io/edit/main/kb/2026-02-23/nginx-ingress-cve.md",source:"@site/kb/2026-02-23/nginx-ingress-cve.md",title:"Upstream Ingress-Nginx CVEs - CVE-2025-15566, CVE-2026-1580, CVE-2026-24512, CVE-2026-24513, and CVE-2026-24514",description:"This article provides information on the CVE-2025-15566, CVE-2026-1580, CVE-2026-24512, CVE-2026-24513, and CVE-2026-24514 vulnerabilities in Harvester.",date:"2026-02-23T00:00:00.000Z",formattedDate:"February 23, 2026",tags:[{label:"security",permalink:"/kb/tags/security"},{label:"cve",permalink:"/kb/tags/cve"}],readingTime:1.79,truncated:!1,authors:[{name:"Ivan Sim",title:"Principal Software Engineer",url:"https://github.com/ihcsim",image_url:"https://github.com/ihcsim.png",imageURL:"https://github.com/ihcsim.png"}],frontMatter:{title:"Upstream Ingress-Nginx CVEs - CVE-2025-15566, CVE-2026-1580, CVE-2026-24512, CVE-2026-24513, and CVE-2026-24514",description:"This article provides information on the CVE-2025-15566, CVE-2026-1580, CVE-2026-24512, CVE-2026-24513, and CVE-2026-24514 vulnerabilities in Harvester.",authors:[{name:"Ivan Sim",title:"Principal Software Engineer",url:"https://github.com/ihcsim",image_url:"https://github.com/ihcsim.png",imageURL:"https://github.com/ihcsim.png"}],tags:["security","cve"],hide_table_of_contents:!1},prevItem:{title:"Regaining Admin/Root Acccess (Lost Password)",permalink:"/kb/regain_admin_access"},nextItem:{title:"Troubleshooting VM Live Migration Issues Caused by Node Selectors",permalink:"/kb/troubleshooting_vm_scheduling_issues_nodeselector"}},u={authorsImageUrls:[void 0]},c=[{value:"References",id:"references",level:2}],m={toc:c};function h(e){var t=e.components,n=(0,a.Z)(e,s);return(0,r.kt)("wrapper",(0,i.Z)({},m,n,{components:t,mdxType:"MDXLayout"}),(0,r.kt)("p",null,"This article provides information and mitigation steps for the following vulnerabilities in Harvester:"),(0,r.kt)("ul",null,(0,r.kt)("li",{parentName:"ul"},(0,r.kt)("a",{parentName:"li",href:"https://github.com/kubernetes/kubernetes/issues/136789"},"CVE-2025-15566")),(0,r.kt)("li",{parentName:"ul"},(0,r.kt)("a",{parentName:"li",href:"https://github.com/kubernetes/kubernetes/issues/136677"},"CVE-2026-1580")),(0,r.kt)("li",{parentName:"ul"},(0,r.kt)("a",{parentName:"li",href:"https://github.com/kubernetes/kubernetes/issues/136678"},"CVE-2026-24512")),(0,r.kt)("li",{parentName:"ul"},(0,r.kt)("a",{parentName:"li",href:"https://github.com/kubernetes/kubernetes/issues/136679"},"CVE-2026-24513")),(0,r.kt)("li",{parentName:"ul"},(0,r.kt)("a",{parentName:"li",href:"https://github.com/kubernetes/kubernetes/issues/136680"},"CVE-2026-24514"))),(0,r.kt)("div",{className:"admonition admonition-info alert alert--info"}

1,(0,r.kt)("div",{parentName:"div",className:"admonition-heading"},(0,r.kt)("h5",{parentName:"div"},(0,r.kt)("span",{parentName:"h5",className:"admonition-icon"},(0,r.kt)("svg",{parentName:"span",xmlns:"http://www.w3.org/2000/svg",width:"14",height:"16",viewBox:"0 0 14 16"},(0,r.kt)("path",{parentName:"svg",fillRule:"evenodd",d:"M7 2.3c3.14 0 5.7 2.56 5.7 5.7s-2.56 5.7-5.7 5.7A5.71 5.71 0 0 1 1.3 8c0-3.14 2.56-5.7 5.7-5.7zM7 1C3.14 1 0 4.14 0 8s3.14 7 7 7 7-3.14 7-7-3.14-7-7-7zm1 3H6v5h2V4zm0 6H6v2h2v-2z"}))),"important")),(0,r.kt)("div",{parentName:"div",className:"admonition-content"},(0,r.kt)("p",{parentName:"div"},"These vulnerabilities affect specific versions of the RKE2 ingress-nginx controller (v1.13.7 and earlier, v1.14.3 and earlier). All Harvester versions that use this controller (including 1.5.2 and earlier, 1.6.1 and earlier, and 1.7.0) are therefore affected."),(0,r.kt)("p",{parentName:"div"},(0,r.kt)("strong",{parentName:"p"},"These CVEs are fixed in Harvester 1.7.1 and newer.")))),(0,r.kt)("div",{className:"admonition admonition-info alert alert--info"},(0,r.kt)("div",{parentName:"div",className:"admonition-heading"},(0,r.kt)("h5",{parentName:"div"},(0,r.kt)("span",{parentName:"h5",className:"admonition-icon"},(0,r.kt)("svg",{parentName:"span",xmlns:"http://www.w3.org/2000/svg",width:"14",height:"16",viewBox:"0 0 14 16"},(0,r.kt)("path",{parentName:"svg",fillRule:"evenodd",d:"M7 2.3c3.14 0 5.7 2.56 5.7 5.7s-2.56 5.7-5.7 5.7A5.71 5.71 0 0 1 1.3 8c0-3.14 2.56-5.7 5.7-5.7zM7 1C3.14 1 0 4.14 0 8s3.14 7 7 7 7-3.14 7-7-3.14-7-7-7zm1 3H6v5h2V4zm0 6H6v2h2v-2z"}))),"important")),(0,r.kt)("div",{parentName:"div",className:"admonition-content"},(0,r.kt)("p",{parentName:"div"},"Harvester does not utilize the ingress-nginx controller custom error backend. Therefore, it is not affected by ",(0,r.kt)("a",{parentName:"p",href:"https://github.com/kubernetes/kubernetes/issues/136679"},"CVE-2026-24513"),"."))),(0,r.kt)("div",{className:"admonition admonition-info alert alert--info"},(0,r.kt)("div",{parentName:"div",className:"admonition-heading"},(0,r.kt)("h5",{parentName:"div"},(0,r.kt)("span",{parentName:"h5",className:"admonition-icon"},(0,r.kt)("svg",{parentName:"span",xmlns:"http://www.w3.org/2000/svg",width:"14",height:"16",viewBox:"0 0 14 16"},(0,r.kt)("path",{parentName:"svg",fillRule:"evenodd",d:"M7 2.3c3.14 0 5.7 2.56 5.7 5.7s-2.56 5.7-5.7 5.7A5.71 5.71 0 0 1 1.3 8c0-3.14 2.56-5.7 5.7-5.7zM7 1C3.14 1 0 4.14 0 8s3.14 7 7 7 7-3.14 7-7-3.14-7-7-7zm1 3H6v5h2V4zm0 6H6v2h2v-2z"}))),"important")),(0,r.kt)("div",{parentName:"div",className:"admonition-content"},(0,r.kt)("p",{parentName:"div"},"Currently, no mitigation is available for ",(0,r.kt)("a",{parentName:"p",href:"https://github.com/kubernetes/kubernetes/issues/136680"},"CVE-2026-24514"),". An upgrade to Harvester 1.7.1 is required."),(0,r.kt)("p",{parentName:"div"},"For more information on its CVSS score, see ",(0,r.kt)("a",{parentName:"p",href:"https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"},"https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H")))),(0,r.kt)("p",null,"You can confirm the version of the RKE2 ingress-nginx pods by running this command on your Harvester cluster:"),(0,r.kt)("pre",null,(0,r.kt)("code",{parentName:"pre",className:"language-sh"},"kubectl -n kube-system get po -l\"app.kubernetes.io/name=rke2-ingress-nginx\" -ojsonpath='{.items[].spec.containers[].image}'\n")),(0,r.kt)("p",null,"If the command returns one of the affected versions, perform one of the following mitigation steps."),(0,r.kt)("p",null,"The primary resolution is to upgrade to Harvester 1.7.1 or newer, which includes the fixed RKE2 ingress-nginx controller."),(0,r.kt)("p",null,"If upgrade is not possible, deploy the following validating admission policy to your cluster to reject ingress resources with the vulnerable configuration:"),(0,r.kt)("pre",null,(0,r.kt)("code",{parentName:"pre",className:"language-sh"},"cat<<EOF | kubectl apply -f -\napiVersion: admissionregistration.k8s.io/v1\nkind: ValidatingAdmissionPolicy\nmetadata:\n  name: ingress-nginx-annotation-validation\nspec:\n  failurePolicy: Fail\n  matchConstraints:\n    resourceRules:\n    - apiGroups:   [\"networking.k8s.io\"]\n      apiVersions: [\"v1\"]\n      operations:  [\"CREATE\", \"UPDATE\"]\n      resources:   [\"ingresses\"]\n  validations:\n    - expression: |\n        !('nginx.ingress.kubernetes.io/auth-proxy-set-headers' in object.metadata.annotations) &&\n        !('nginx.ingress.kubernetes.io/auth-method' in object.metadata.annotations) &&\n        (object.spec.rules.all(rule, rule.http.paths.all(path, path.pathType != 'ImplementationSpecific')))\n      message: \"Ingress resources with the vulnerable annotations are not allowed. Please remove the 'nginx.ingress.kubernetes.io/auth-proxy-set-headers' and 'nginx.ingress.kubernetes.io/auth-method' annotations, and avoid using the 'ImplementationSpecific' path type.\"\n---\napiVersion: admissionregistration.k8s.io/v1\nkind: ValidatingAdmissionPolicyBinding\nmetadata:\n  name: ingress-nginx-annotation-validation\nspec:\n  policyName: ingress-nginx-annotation-validation\n  validationActions: [Deny]\nEOF\n")),(0,r.kt)("div",{className:"admonition admonition-info alert alert--info"}

1,(0,r.kt)("div",{parentName:"div",className:"admonition-heading"},(0,r.kt)("h5",{parentName:"div"},(0,r.kt)("span",{parentName:"h5",className:"admonition-icon"},(0,r.kt)("svg",{parentName:"span",xmlns:"http://www.w3.org/2000/svg",width:"14",height:"16",viewBox:"0 0 14 16"},(0,r.kt)("path",{parentName:"svg",fillRule:"evenodd",d:"M7 2.3c3.14 0 5.7 2.56 5.7 5.7s-2.56 5.7-5.7 5.7A5.71 5.71 0 0 1 1.3 8c0-3.14 2.56-5.7 5.7-5.7zM7 1C3.14 1 0 4.14 0 8s3.14 7 7 7 7-3.14 7-7-3.14-7-7-7zm1 3H6v5h2V4zm0 6H6v2h2v-2z"}))),"info")),(0,r.kt)("div",{parentName:"div",className:"admonition-content"},(0,r.kt)("p",{parentName:"div"},"This policy is a cluster-scoped resource that requires the proper administrator RBAC permissions to create."))),(0,r.kt)("p",null,"This validating policy rejects any ingress resources that contain the:"),(0,r.kt)("ul",null,(0,r.kt)("li",{parentName:"ul"},(0,r.kt)("inlineCode",{parentName:"li"},"nginx.ingress.kubernetes.io/auth-proxy-set-headers")," annotation"),(0,r.kt)("li",{parentName:"ul"},(0,r.kt)("inlineCode",{parentName:"li"},"nginx.ingress.kubernetes.io/auth-method")," annotation"),(0,r.kt)("li",{parentName:"ul"},(0,r.kt)("inlineCode",{parentName:"li"},"ImplementationSpecific")," path type")),(0,r.kt)("p",null,"The policy can be removed once you upgrade to Harvester 1.7.1 or newer:"),(0,r.kt)("pre",null,(0,r.kt)("code",{parentName:"pre",className:"language-sh"},"kubectl delete validatingadmissionpolicy ingress-nginx-annotation-validation\n\nkubectl delete validatingadmissionpolicybinding ingress-nginx-annotation-validation\n")),(0,r.kt)("h2",{id:"references"},"References"),(0,r.kt)("ul",null,(0,r.kt)("li",{parentName:"ul"},(0,r.kt)("a",{parentName:"li",href:"https://github.com/kubernetes/kubernetes/issues/136789"},"https://github.com/kubernetes/kubernetes/issues/136789")),(0,r.kt)("li",{parentName:"ul"},(0,r.kt)("a",{parentName:"li",href:"https://github.com/kubernetes/kubernetes/issues/136677"},"https://github.com/kubernetes/kubernetes/issues/136677")),(0,r.kt)("li",{parentName:"ul"},(0,r.kt)("a",{parentName:"li",href:"https://github.com/kubernetes/kubernetes/issues/136678"},"https://github.com/kubernetes/kubernetes/issues/136678")),(0,r.kt)("li",{parentName:"ul"},(0,r.kt)("a",{parentName:"li",href:"https://github.com/kubernetes/kubernetes/issues/136679"},"https://github.com/kubernetes/kubernetes/issues/136679")),(0,r.kt)("li",{parentName:"ul"},(0,r.kt)("a",{parentName:"li",href:"https://github.com/kubernetes/kubernetes/issues/136680"},"https://github.com/kubernetes/kubernetes/issues/136680")),(0,r.kt)("li",{parentName:"ul"},(0,r.kt)("a",{parentName:"li",href:"https://support.scc.suse.com/s/kb/Upstream-Ingress-Nginx-CVEs-CVE-2025-15566-CVE-2026-1580-CVE-2026-24512-CVE-2026-24513-and-CVE-2026-24514"},"https://support.scc.suse.com/s/kb/Upstream-Ingress-Nginx-CVEs-CVE-2025-15566-CVE-2026-1580-CVE-2026-24512-CVE-2026-24513-and-CVE-2026-24514"))))}h.isMDXComponent=!0}}]);