CVE-2026-24513

Executive Summary

CVE-2026-24513 is a low-severity (CVSS 3.1) security advisory affecting ingress-nginx, the Kubernetes ingress controller. The vulnerability arises when an administrator configures a custom-errors backend that is defective and fails to respect the X-Code HTTP header. Under this specific misconfiguration, an Ingress resource using the auth-url annotation may be accessed even when authentication fails, effectively bypassing the intended authentication enforcement. The built-in custom-errors backend is not affected. This issue requires a broken external component to be exploitable, significantly reducing its practical risk.

Supply Chain & Package Security

This vulnerability is not related to a package manager (NPM, PyPI, Go, Ruby) but to a Kubernetes ecosystem component (ingress-nginx). The risk is limited to environments where administrators have explicitly configured a non-standard, defective custom-errors backend.

CVSS Breakdown & Threat Level

• CVSS Score: 3.1 (Low)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
• Attack Vector (AV): Network (N) – The attack is exploitable remotely over the network.
• Attack Complexity (AC): Low (L) – No special conditions are required for exploitation.
• Privileges Required (PR): None (N) – No authentication is needed to trigger the vulnerability.
• User Interaction (UI): None (N) – No user action is required.
• Scope (S): Unchanged (U) – The vulnerable component and the impacted component are the same.
• Confidentiality (C): Low (L) – Limited information disclosure (access to protected resources).
• Integrity (I): None (N) – No data modification.
• Availability (A): None (N) – No denial of service.

Threat Level: Low. The vulnerability requires a specific misconfiguration (a broken custom-errors backend) that is not the default. Exploitation is possible but unlikely in well-managed environments.

Deep Dive & Mechanics

The auth-url annotation in ingress-nginx allows an administrator to specify an external authentication service. When a request arrives, ingress-nginx sends a sub-request to the auth-url endpoint. If the authentication service returns a 401 (Unauthorized) or 403 (Forbidden) status, ingress-nginx normally blocks the request.

The vulnerability occurs when:

1. The ingress-nginx controller is configured with a default custom-errors configuration that includes HTTP errors 401 or 403.
2. The configured default custom-errors backend is defective and fails to respect the X-Code HTTP header.

The X-Code header is used by ingress-nginx to communicate the original error code to the custom-errors backend. If the backend ignores this header and returns a success response (e.g., 200 OK) instead of the error code, ingress-nginx may treat the request as authenticated and allow access.

Root Cause: The ingress-nginx controller trusts the custom-errors backend to correctly handle the X-Code header. A defective backend that returns a 200 OK for all requests will cause the controller to bypass authentication.

Prerequisites for Exploitation:

• The ingress-nginx controller must have a custom-errors configuration that includes 401 or 403 errors.
• The custom-errors backend must be defective (i.e., it does not respect the X-Code header).
• An Ingress resource must use the auth-url annotation.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual): The vulnerable logic is in the ingress-nginx controller's error handling. When a custom-errors backend is configured, the controller sends the error code via the X-Code header and expects the backend to return the same error code. If the backend returns a 200 OK, the controller may treat the request as successful.

// Vulnerable pseudocode
func handleAuthError(w http.ResponseWriter, r *http.Request) {
    if customErrorsBackend != nil {
        // Send request to custom-errors backend with X-Code header
        resp, err := http.Post(customErrorsBackend, "application/json", body)
        if err == nil && resp.StatusCode == 200 {
            // Trust the backend and allow access
            w.WriteHeader(200)
            return
        }
    }
    // Default behavior: deny access
    w.WriteHeader(403)
}

Patched Code (Conceptual): The patched code should validate that the custom-errors backend returns the expected error code, or fall back to the default behavior if the backend is defective.

// Patched pseudocode
func handleAuthError(w http.ResponseWriter, r *http.Request) {
    if customErrorsBackend != nil {
        resp, err := http.Post(customErrorsBackend, "application/json", body)
        if err == nil && resp.StatusCode == 401 || resp.StatusCode == 403 {
            // Backend correctly returned an error code
            w.WriteHeader(resp.StatusCode)
            return
        }
        // Backend returned unexpected status, fall back to default
        w.WriteHeader(403)
        return
    }
    w.WriteHeader(403)
}

Note: No official patch has been released at this time. The above is a conceptual fix.

Exploitation & Lab Setup

Red Team

Lab Setup:

1. Deploy a Kubernetes cluster with ingress-nginx installed.
2. Configure a custom-errors backend that is defective (e.g., a simple HTTP server that always returns 200 OK).
3. Create an Ingress resource with the auth-url annotation pointing to an external authentication service.
4. Send a request to the Ingress without valid authentication.

Exploitation Steps:

1. Identify an ingress-nginx controller with a custom-errors configuration.
2. Send a request to a protected endpoint without authentication.
3. Observe that the request is allowed despite the auth-url annotation.

Example Request:

curl -v http://target-ingress/protected-endpoint

Expected Result: The request is allowed (HTTP 200 OK) even though authentication should have failed.

Blue Team

Detection:

1. Monitor for requests that bypass authentication to protected endpoints.
2. Check ingress-nginx logs for unexpected 200 responses from custom-errors backends.
3. Audit custom-errors backend configurations for defective implementations.

Mitigation:

1. Use the built-in custom-errors backend instead of a custom one.
2. If a custom backend is required, ensure it correctly handles the X-Code header.
3. Implement network segmentation to limit access to the custom-errors backend.

Indicators of Compromise (IOCs)

• Log Entry: "custom-errors backend returned unexpected status code 200 for X-Code 401"
• Network Traffic: Requests to protected endpoints that should have been blocked but were allowed.
• Configuration: Presence of a custom-errors backend that does not respect the X-Code header.

Detection Engineering

YARA Rule

rule CVE_2026_24513_Ingress_Nginx_Auth_Bypass {
    meta:
        description = "Detects ingress-nginx configurations with defective custom-errors backends"
        author = "Valters IT"
        date = "2026-01-01"
        reference = "CVE-2026-24513"
    strings:
        $config1 = "custom-errors" nocase
        $config2 = "auth-url" nocase
        $config3 = "X-Code" nocase
    condition:
        all of ($config*) and #config1 > 0
}

Sigma Rule

title: CVE-2026-24513 - Ingress-Nginx Auth Bypass via Defective Custom-Errors Backend
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects requests that bypass authentication due to a defective custom-errors backend
author: Valters IT
date: 2026-01-01
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-24513
logsource:
    category: application
    product: ingress-nginx
detection:
    selection:
        - "custom-errors backend returned unexpected status code 200 for X-Code 401"
        - "custom-errors backend returned unexpected status code 200 for X-Code 403"
    condition: selection
falsepositives:
    - Legitimate custom-errors backends that correctly handle X-Code
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2026-24513 - Ingress-Nginx Auth Bypass via Defective Custom-Errors Backend"; flow:to_server; content:"X-Code"; http_header; content:"200"; http_server_body; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate: Disable custom-errors backends and use the built-in default.
2. Short-term: If a custom backend is required, audit it to ensure it correctly handles the X-Code header.
3. Long-term: Apply the official patch when released by the ingress-nginx project.
4. Monitoring: Implement logging and alerting for unexpected responses from custom-errors backends.
5. Network Security: Restrict access to the custom-errors backend to only the ingress-nginx controller.

Workaround: Remove the custom-errors configuration from the ingress-nginx controller and rely on the built-in backend.

Valters IT
DevSecOps & Cyber Threat Intelligence