ingress-nginx End-of-Life: Email Security Migration Guide

Your ingress controller might be running code with a known critical vulnerability. That is not a hypothetical - it is the current state of ingress-nginx.

Upstream kubernetes/ingress-nginx is archived. No further releases are coming. The last controller image still in common use embeds NGINX 1.27.1, which is affected by CVE-2026-42945 - a CVSS v4.0 9.2 vulnerability in the ngx_http_rewrite_module.

This article covers what the CVE does, how to check your exposure, and what your actual migration options are.

What CVE-2026-42945 actually does

The vulnerability lives in NGINX's rewrite module. It triggers when a rewrite directive uses unnamed PCRE captures (like $1 or $2) with a ? in the replacement string, and another rewrite, if, or set directive follows in the same scope.

Example trigger pattern:


rewrite ^/old/(.*)$ /new/?$1 last;
set $var something;

The bug is a buffer over-read that can crash the worker process or, in specific conditions with ASLR already bypassed, allow remote code execution. In practice, even without RCE, a crashing worker process can be weaponized for denial-of-service against your ingress traffic.

Which ingress-nginx versions are affected

Any ingress-nginx deployment still on the archived main branch is running NGINX 1.27.1 at latest. That version is vulnerable.

You might believe you are safe because nginx -v on the host shows a newer version. That check does not matter - what matters is the NGINX version compiled into the controller container image, not the host binary.

How to check your ingress-nginx version

Run this command against a running ingress-nginx pod:


kubectl exec -n ingress-nginx  -- /nginx-ingress-controller --version

If the output reports a version that embeds NGINX below 1.30.1 or 1.31.0, you are running a vulnerable build.

NVD link: https://nvd.nist.gov/vuln/detail/CVE-2026-42945

Your three mitigation options

Option 1: Switch to a maintained fork

Projects like Forkline publish ingress-nginx images that have bumped the embedded NGINX to a patched version. This is the fastest path to a secure, supported state without changing your ingress configuration.

Option 2: Upgrade NGINX directly

If your ingress-nginx build process allows rebuilding the image with a newer NGINX, you can upgrade to 1.30.1 or 1.31.0 directly. This requires image rebuild and redeployment but keeps your existing configuration intact.

Option 3: Migrate to Gateway API

The long-term recommended path is to migrate from ingress-nginx to a Gateway API implementation. This is not a quick fix - it involves rewriting ingress resources to Gateway API semantics, updating routing rules, and testing failover behavior. But it is the only path that moves away from archived software entirely.

Why this matters for email authentication

During a migration of this kind, you will change DNS records. Any time DNS changes during an infrastructure migration, your email authentication setup is at risk.

If your domain's DMARC, SPF, or DKIM records are managed through the same DNS infrastructure you are reconfiguring for the Gateway API migration, a misconfigured record can go unnoticed until a receiving mail server rejects your legitimate mail.

The problem is that DNS changes during a migration are often made quickly, under pressure, with incomplete testing across all the services that depend on those records. Email authentication is silent - you might not know a record is wrong until mail stops arriving.

How to watch your DNS during ingress migrations

DMARCFlow monitors DNS records across your domain portfolio and alerts you when any DMARC, SPF, or DKIM record changes unexpectedly. During an ingress-nginx migration - or any DNS change event - a misconfigured record can silently break email authentication, and you may not know it until mail starts bouncing. DMARCFlow catches those changes automatically and notifies you before the problem reaches your users.

This is not an email security feature that competes with your ingress migration - it is infrastructure that watches the edges of your email authentication while you reconfigure everything else.

FAQ

Q: Can I just disable the rewrite rule and stay on ingress-nginx?

If your ingress-nginx configuration does not use unnamed captures ($1, $2) with a ? in rewrite replacements, you are not directly affected by CVE-2026-42945. However, the controller image is still archived and will not receive future security patches. Running on deprecated software is a risk even if the current CVE does not apply to your specific config.

Q: How hard is it to migrate from ingress-nginx to Gateway API?

It depends on your configuration complexity. Simple ingress resources with basic host/path rules can be translated mechanically. Configurations with extensive annotations, custom templates, or complex rewrite rules require more work. Budget time for thorough testing - this is where DNS and email authentication errors tend to hide.

Q: Should I migrate everything at once or incrementally?

Incremental migration with a weighted split (send a percentage of traffic to the new Gateway API implementation while keeping ingress-nginx running) is the safer approach. It lets you validate behavior before cutting over completely.

Q: Who should I tell about this?

Tell whoever owns the Kubernetes cluster, whoever manages the DNS for your domain, and whoever is responsible for email deliverability. All three are involved in a safe migration.

ingress-nginx being archived is not a reason to panic. It is a reason to plan. Check your version, pick your migration path, and make sure nothing in that migration silently breaks your email authentication - because silent email breakage is expensive to debug and worse to explain to users.