Ingress NGINX retirement

By Jack McGuire, Principal Consultant

The Kubernetes community retired Ingress NGINX as of March 2026, which means no further releases, bug fixes or security updates for that controller.

With the Stable 2026.03 release of SAS Viya, SAS now provides support for Contour Ingress Controller in all Stable and Long-Term Support (LTS) releases of the SAS Viya platform and solutions that are in Standard Support.

Active security risk on ingress‑nginx

There are three high‑severity CVEs that have been published so far in 2026 that affect ingress‑nginx. If your cluster still runs ingress‑nginx you should treat these as priority risks:

• CVE‑2026‑3288. Configuration injection via the rewrite-target annotation. CVSS 8.8 High. [nvd.nist.gov]
• CVE‑2026‑24512. Configuration injection via rules.http.paths.path. CVSS 8.8 High. [nvd.nist.gov]
• CVE‑2026‑1580. Configuration injection via the auth-method annotation. CVSS 8.8 High. [nvd.nist.gov]

Recommended path: migrate to Contour

SAS’s guidance is to update to a SAS Viya version that supports Contour, then convert your ingress to Contour using the documented steps. Key points:

• If your platform is already on the latest Long Term Stable release (2025.09), then apply the latest patch updates while making the change to Contour.
• If your platform is not already on the latest Long Term Stable release (2025.09) or is on a Stable release before 2025.02, make the change to Contour while performing a version update of your SAS Viya platform deployment.
• Always consult the current Deployment Notes and What’s New in Operations before you update, as these documents flag critical changes and prerequisites.

If you must stay on ingress‑nginx temporarily

• Ensure you are on the latest version of ingress‑nginx (v1.15.0)
• Ensure the vulnerability mitigations have been implemented: SAS Viya Platform Operation: ingress-nginx Controller Vulnerability Mitigation

What’s next

The Katalyze Data team can help you review your current deployment, confirm support status, plan the update, and ensure a safe ingress cut‑over to Contour.