Auth-method flaw in ingress-nginx exposes clusters to configuration injection

A vulnerability in ingress-nginx's auth-method implementation (CVE-2026-1580) permits injection of arbitrary nginx configuration directives through malicious authentication headers. The flaw stems from insufficient sanitization of user-supplied input in auth annotations, potentially allowing attackers to modify proxy settings or request routing. This affects all ingress-nginx versions prior to patched releases. Cluster administrators should upgrade to ingress-nginx controller v1.9.0+ and audit existing auth-related annotations for unexpected directives.