Kubernetes NGINX Rift Audit

Read-only Kubernetes scanner for NGINX Rift, CVE-2026-42945. It looks for NGINX containers in running pods, reads their effective NGINX configuration, and reports rewrite directives whose replacement contains a literal ?.

The scanner uses Python standard library plus the local kubectl binary. It does not create, update, or delete Kubernetes resources.

Quick Start

Run against the current kubeconfig context:

curl -fsSL https://raw.githubusercontent.com/OWNER/REPO/main/kube-audit/nginx_rift_k8s_scan.py \
  | python3 -

Run with an explicit kubeconfig:

curl -fsSL https://raw.githubusercontent.com/OWNER/REPO/main/kube-audit/nginx_rift_k8s_scan.py \
  | python3 - --kubeconfig /path/to/kubeconfig

Run with an explicit context and JSON output:

curl -fsSL https://raw.githubusercontent.com/OWNER/REPO/main/kube-audit/nginx_rift_k8s_scan.py \
  | python3 - --context my-context --json

What It Checks

For each running container, the script tries to find nginx or openresty. For containers with NGINX, it collects:

nginx -v version output
effective config via nginx -T
live /etc/nginx/nginx.conf fallback for ingress-nginx controllers when nginx -T fails

It then parses rewrite directives and flags replacements containing a literal ?, for example:

rewrite ^/api/(.*)$ /internal?migrated=true;

This is the key NGINX Rift configuration primitive described in the public PoC. The script also reports affected NGINX Open Source versions, but version alone does not prove exploitability; the dangerous rewrite pattern must be present in the active configuration.

Exit Codes

0: no rewrite replacement containing literal ? was found
1: at least one potential NGINX Rift rewrite trigger was found
2: scan failed or completed with partial errors

Options

--kubeconfig PATH       kubeconfig path
--context NAME          kubeconfig context
--namespace NAME        scan one namespace instead of all namespaces
--timeout SECONDS       per-kubectl-call timeout, default 20
--workers N             parallel kubectl exec workers, default 8
--json                  emit JSON report
--verbose               include per-container details
--no-ingress-conf       disable /etc/nginx/nginx.conf fallback for ingress-nginx when nginx -T fails

Required Permissions

The current Kubernetes identity needs permission to:

list pods
exec into pods

No write permissions are required.

2.5 KiB Raw Blame History