Ingress NGINX Retired Amid New Critical Vulnerabilities – Migrate to Alibaba Cloud API Gateway in 10 Minutes

Ingress NGINX was officially retired on 2026‑03‑24; while existing controllers can still run, the project no longer receives new releases, bug fixes, or security patches. New high‑severity vulnerabilities continue to be disclosed, such as CVE‑2026‑42945 and CVE‑2026‑9256 (both affecting ngx_http_rewrite_module and causing heap buffer overflows that can crash or potentially execute code) and CVE‑2026‑42533 (affecting the map directive’s regex handling). All three have CVSS v3.1 scores of 8.1 and impact the official NGINX images used by Ingress NGINX.

Because the retired controller will never receive upstream patches, clusters that still rely on it face increasing risk: even if upstream NGINX releases fixes, they will not be incorporated into the Ingress NGINX controller image, leaving users without a remediation path.

To address this, Alibaba Cloud’s Cloud Native API Gateway has enhanced its migration capabilities. The new features include:

Extending entry‑reuse support from CLB to NLB, allowing the same load‑balancer address and DNS configuration to be retained during migration.

Analyzing Ingress annotations for compatibility; over 90 % of common annotations can be reused directly, while the remaining ones are classified and handled via a Skill that generates native configuration, built‑in plugin settings, or custom Wasm plugin code.

Integrating migration, traffic‑shifting, and rollback into a single console workflow, eliminating the need to switch between the ACK console and the API‑gateway console.

Upgrade 1 – Entry‑reuse from CLB to NLB : The migration tool now supports both CLB and NLB as the upstream load balancer, keeping the original address unchanged and allowing parallel traffic between the old NGINX Ingress and the new gateway.

Upgrade 2 – Annotation compatibility analysis : The Skill scans Ingress resources, reports compatible annotations, and for incompatible ones provides prioritized handling suggestions: (1) keep as‑is if already supported, (2) map to native gateway configuration, (3) remove if safe, (4) use built‑in plugins, (5) generate custom Wasm plugins when necessary.

Upgrade 3 – Integrated migration, traffic‑shifting, and rollback : The console now provides one‑click updates of Service annotations, allows setting the target traffic ratio (0 %–100 %) with incremental steps (max +25 % per adjustment), and enforces task state control to prevent overlapping changes. If an issue occurs, the traffic can be quickly reduced or rolled back to 0 %.

The end‑to‑end migration workflow consists of five stages:

Confirm environment – verify API‑gateway version, ACK CCM version, IngressClass, load‑balancer type, and listener settings.

Migrate routes – import or listen to existing Ingress resources, preserving compatible annotations.

Handle differences – run the migration Skill to generate native configurations, plugins, or Wasm code for incompatible annotations.

Validate links – access the gateway entry (e.g., via local /etc/hosts) to confirm routing and business behavior.

Switch traffic – gradually shift weight from the original CLB/NLB to the gateway, monitor stability, then complete the migration.

During migration, it is recommended to keep the original Ingress, Service, and NGINX controller until traffic has fully switched and a observation period has passed, providing a safe rollback path.

In summary, the retirement of Ingress NGINX expands the attack surface and eliminates official security updates; the Cloud Native API Gateway’s upgraded migration tool mitigates these risks by simplifying entry reuse, annotation handling, and traffic management, enabling a secure and controlled migration in as little as ten minutes.