Kubernetes’ Ingress NGINX Retirement Leaves Deployments Without Patches After March 2026
Summary
Ingress NGINX will receive no releases, bug fixes, or security patches after March 2026. Datadog urges operators to inventory deployments and plan migration to a Gateway API-conformant controller, citing past and newly disclosed vulnerabilities.
Key points
- After March 2026, Ingress NGINX will receive no further releases, bug fixes, or security updates.
- The article cites CVE-2025-1974, an unauthenticated RCE flaw disclosed in March 2025, as a prior example of the product’s security risk.
- Operators can check for deployments with `kubectl get pods --all-namespaces --selector app.kubernetes.io/name=ingress-nginx`.
- The article recommends planning a migration to a Gateway API-conformant controller and warns that alternatives are not direct drop-in replacements.
- The Kubernetes statement estimates that about 50% of cloud native environments rely on Ingress NGINX, based on Datadog telemetry.
- Four HIGH-severity vulnerabilities—CVE-2026-1580, CVE-2026-24512, CVE-2026-24513, and CVE-2026-24514—were disclosed on February 2, 2026, according to the article.
Article Details
- Event Type
- Kubernetes announced the retirement of Ingress NGINX after March 2026, with no further releases, bug fixes, or security patches.
- Impact
- Organizations still using Ingress NGINX will need to plan a migration because future vulnerabilities will not receive official patches after retirement. The article reports that the Kubernetes statement estimates about 50% of cloud native environments rely on Ingress NGINX, based on Datadog telemetry. It cites the prior unauthenticated remote code execution and cluster-takeover vulnerability CVE-2025-1974, and four HIGH severity vulnerabilities disclosed on February 2, 2026, as evidence of ongoing risk.
MITRE ATT&CK
CVE
CVE-2025-1974kubernetes · ingress-nginxThe post highlights past critical flaws including the CVE-2025-1974 “IngressNightmare” RCE and urges immediate checks and migration planning to Gateway API–conformant controllers.CVE-2026-1580Kubernetes · ingress-nginxFour new HIGH severity CVEs (CVE-2026-1580, CVE-2026-24512, CVE-2026-24513, CVE-2026-24514) were disclosed on Feb 2, 2026, underscoring the ongoing risk of running unmaintained Ingress NGINX.CVE-2026-24512Kubernetes · ingress-nginxFour new HIGH severity CVEs (CVE-2026-1580, CVE-2026-24512, CVE-2026-24513, CVE-2026-24514) were disclosed on Feb 2, 2026, underscoring the ongoing risk of running unmaintained Ingress NGINX.CVE-2026-24513Kubernetes · ingress-nginxFour new HIGH severity CVEs (CVE-2026-1580, CVE-2026-24512, CVE-2026-24513, CVE-2026-24514) were disclosed on Feb 2, 2026, underscoring the ongoing risk of running unmaintained Ingress NGINX.CVE-2026-24514Kubernetes · ingress-nginxFour new HIGH severity CVEs (CVE-2026-1580, CVE-2026-24512, CVE-2026-24513, CVE-2026-24514) were disclosed on Feb 2, 2026, underscoring the ongoing risk of running unmaintained Ingress NGINX.
Vendors
Products
Gateway APIThe post highlights past critical flaws including the CVE-2025-1974 “IngressNightmare” RCE and urges immediate checks and migration planning to Gateway API–conformant controllers.Ingress NGINXKubernetes has announced that Ingress NGINX will be retired after March 2026, meaning no further releases, bug fixes, or security patches will be provided and organizations must migrate away.KubernetesKubernetes has announced that Ingress NGINX will be retired after March 2026, meaning no further releases, bug fixes, or security patches will be provided and organizations must migrate away.