The vulnerability arises when ingress-nginx is configured with a default custom-errors mapping that includes HTTP error codes 401 or 403 and a defective external custom-errors backend that does not honor the X-Code header. Under these conditions, an Ingress resource annotated with auth-url can be accessed even though authentication has failed, effectively bypassing the intended protection. The consequence is that an attacker can reach resources behind the ingress without valid credentials, potentially exposing sensitive data or services.

Affected deployments are Kubernetes ingress-nginx controllers that have been configured with a broken external custom-errors backend and that use the auth-url annotation for authentication. No specific product version is identified, so any release of ingress-nginx that allows this misconfiguration is potentially impacted.

The CVSS score of 3.1 indicates low severity, and the EPSS score of less than 1% suggests a very low probability of exploitation. The vulnerability is not in the CISA KEV catalog. Exploitation requires an administrator to configure a faulty custom-errors backend; thus the attack vector is limited to privileged access or supply of misconfigured components. The risk to most environments is low unless the misconfiguration exists.