Kubernetes: ingress-nginx DOS

nginx

A security issue was discovered in ingress-nginx, allowing a user to cause denial of service of the ingress-nginx data plane.

Do this now

Upgrade ingress-nginx to 1.15.2-prime1 to fix the denial of service issue.

Who should check: teams running nginx

Fix it

nginx

No fix yet: all versions affected

Rancher Prime RKE2 ingress-nginx

Upgrade to Rancher Prime RKE2 ingress-nginx 1.15.2-prime1

Fixed for Rancher Prime RKE2 ingress-nginx; still cooking for nginx.

First seen: 5 Nov 2026
Last update: 5 Nov 2026, 20:18 UTC
Fixed in: 1.15.2-prime1
Identifiers: CVE-2026-116472
CVSS: 2.7
Source: news
On the menu as: nginx

Check this repository for exposure to one security incident from pwned.coffee. Report first, change nothing until I say so.

## Kubernetes: ingress-nginx DOS
Severity: low. Patch status: partial fix.
Affected: nginx
Fixed in: 1.15.2-prime1
Ids: CVE-2026-116472

A security issue was discovered in ingress-nginx, allowing a user to cause denial of service of the ingress-nginx data plane.

## Steps
1. This touches infrastructure (nginx). Look in terraform, ansible, cloud-init, Dockerfiles and docs for the product and version we run. If it isn't in the repo, say so and list what a human should check on the box.
2. Fix by release line: Rancher Prime RKE2 ingress-nginx: 1.15.2-prime1. No fix yet on nginx. Until one ships: restrict network access to it.

## Fix by release line
| Line | State | Fix | Until then |
|---|---|---|---|
| nginx | no fix yet | — | restrict network access to it |
| Rancher Prime RKE2 ingress-nginx | fixed | 1.15.2-prime1 | — |

## Report
A table: file, product or package, version in use, affected yes/no, exact fix. Then anything a human has to check outside the repo.

If you have the pwned.coffee MCP server (https://pwned.coffee/mcp), call lookup_cve("CVE-2026-116472") for the latest, and check_repo with this repo's lockfiles, Dockerfiles and workflows for a full receipt.
Sources: https://seclists.org/oss-sec/2026/q4/523
https://pwned.coffee/i/kubernetes-ingress-nginx-dos-cve-2026-116472

Timeline

5 Nov 2026, 20:18 UTC
Fix status: no fix yet → partial fix.
5 Nov 2026
First reported.

Receipt

Exploitation: No known exploitation
Fix by release line: Product Affected Fixed in Source
nginx all no fix yet: all versions affected CVE record (CNA) checked 5 Nov
Rancher Prime RKE2 ingress-nginx before 1.15.2-prime1 1.15.2-prime1 CVE record (CNA) checked 5 Nov
Score: CVSS 2.7 (low). CVSS 3.1 2.7 (CNA kubernetes) for CVE-2026-116472
Last checked: 6 Nov 2026, 12:18 UTC

Product	Affected	Fixed in	Source
nginx	all	no fix yet: all versions affected	CVE record (CNA) checked 5 Nov
Rancher Prime RKE2 ingress-nginx	before 1.15.2-prime1	1.15.2-prime1	CVE record (CNA) checked 5 Nov

Sources: KEV – CVE record ✓ Vendor ✓

Sources

seclists.org: [kubernetes] CVE-2026-116472: ingress-nginx mirror-target self-DOS

Follow on X

Totalone coffee