BIT-NGINX-INGRESS-CONTROLLER-2020-8553 Kubernetes ingress-nginx Compromise of auth via subset/superset namespace names

The Kubernetes ingress-nginx component prior to version 0.28.0 allows a user with the ability to create namespaces and to read and create ingress objects to overwrite the password file of another ingress which uses nginx.ingress.kubernetes.io/auth-type: basic and which has a hyphenated namespace ...

BIT-NGINX-INGRESS-CONTROLLER-2021-25745 Ingress-nginx path can be pointed to service account token file

A security issue was discovered in ingress-nginx where a user that can create or update ingress objects can use the spec.rules.http.paths.path field of an Ingress object in the networking.k8s.io or extensions API group to obtain the credentials of the ingress-nginx controller. In the default...

BIT-NGINX-INGRESS-CONTROLLER-2021-25746 Ingress-nginx directive injection via annotations

A security issue was discovered in ingress-nginx where a user that can create or update ingress objects can use .metadata.annotations in an Ingress object in the networking.k8s.io or extensions API group to obtain the credentials of the ingress-nginx controller. In the default configuration, that...

BIT-NGINX-INGRESS-CONTROLLER-2021-25748 Ingress-nginx `path` sanitization can be bypassed with newline character

A security issue was discovered in ingress-nginx where a user that can create or update ingress objects can use a newline character to bypass the sanitization of the spec.rules.http.paths.path field of an Ingress object in the networking.k8s.io or extensions API group to obtain the credentials of...

BIT-NGINX-INGRESS-CONTROLLER-2022-4886 Ingress-nginx `path` sanitization can be bypassed with `log_format` directive

Ingress-nginx path sanitization can be bypassed with logformat directive...

CVE-2024-24786 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-kms, grpcurl, hugo, configmap-reload, prometheus-beat-exporter, tigera-operator, cosign-fips, caddy, kubeflow-pipelines, flux-kustomize-controller, secrets-store-csi-driver-provider-aws, fulcio, kiam, policy-controller,...

CVE-2024-21626 vulnerabilities

Vulnerabilities for packages: zot, k3d, syft, k9s, buildkitd, kubescape, newrelic-infrastructure-agent, wolfictl, trivy, podman, kaniko, zarf, skopeo, kubernetes, kots, docker, k3s, cadvisor, skaffold, runc, nerdctl, ctop, grype...

CVE-2024-21626 vulnerabilities

Vulnerabilities for packages: kubernetes, skaffold, k3d, cadvisor, kots, podman, trivy, zot, nerdctl, newrelic-infrastructure-agent, k9s, ctop, zarf, kaniko, wolfictl, runc, grype, skopeo, kubescape, buildkitd, syft, k3s, docker...

Exploit for Improper Input Validation in Kubernetes Ingress-Nginx

CVE-2023-5044 Ingress Nginx Exploit Proof-Of-Concept This is...

The vulnerability of the ingress controller in the Kubernetes cluster ingress-nginx allows a hacker to execute arbitrary code or increase their privileges.

The vulnerability of the ingress controller in the Kubernetes cluster ingress-nginx is related to errors in processing incoming data. Exploiting this vulnerability allows a malicious actor to execute arbitrary code or increase their privileges using the logformat directive...

Arbitrary Code Execution

github.com/kubernetes/ingress-nginx is vulnerable to Arbitrary Code Execution. The vulnerability arises from the library's default lack of proper annotation validation. This deficiency enables an attacker to inject and execute malicious code through the...

Improper Access Control

github.com/kubernetes/ingress-nginx is vulnerable to Improper Access Control. The vulnerability exists because the library does not adequately validate path types. Consequently, an attacker with the ability to create or update ingress objects can utilize directives to evade the sanitization of th...

SUSE CVE-2022-4886

Ingress-nginx path sanitization can be bypassed with logformat directive...

SUSE CVE-2023-5043

Ingress nginx annotation injection causes arbitrary command execution...

The vulnerability of the nginx.ingress.kubernetes.io/configuration-snippet component in the Kubernetes ingress-nginx cluster allows a attacker to execute arbitrary code or escalate their privileges.

The vulnerability of the nginx.ingress.kubernetes.io/configuration-snippet component, which handles incoming traffic in the Kubernetes ingress-nginx cluster, is related to errors in processing input data. Exploiting this vulnerability allows a malicious actor to execute arbitrary code or increase...

Ingress-nginx code injection via nginx.ingress.kubernetes.io/permanent-redirect annotation

A security issue was identified in ingress-nginx where the nginx.ingress.kubernetes.io/permanent-redirect annotation on an Ingress object in the networking.k8s.io or extensions API group can be used to inject arbitrary commands, and obtain the credentials of the ingress-nginx controller. In the...

GHSA-FP9F-44C2-CW27 vulnerabilities

Vulnerabilities for packages: ingress-nginx-controller...

GHSA-5WJ4-WFFQ-3378 vulnerabilities

Vulnerabilities for packages: ingress-nginx-controller...

GHSA-5WJ4-WFFQ-3378 vulnerabilities

Vulnerabilities for packages: ingress-nginx-controller...

GHSA-FP9F-44C2-CW27 Ingress-nginx code injection via nginx.ingress.kubernetes.io/permanent-redirect annotation

A security issue was identified in ingress-nginx where the nginx.ingress.kubernetes.io/permanent-redirect annotation on an Ingress object in the networking.k8s.io or extensions API group can be used to inject arbitrary commands, and obtain the credentials of the ingress-nginx controller. In the...