ingress-nginx controller configuration injection via unsanitized auth-url annotation

CVSS Rating: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Score: 8.8, High A security issue was discovered in ingress-nginx where the \auth-url\ Ingress annotation can be used to inject configuration into nginx. This can lead to arbitrary code execution in the context of the ingress-nginx...

ingress-nginx controller auth secret file path traversal vulnerability

CVSS Rating: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L Score: 4.8, Medium A security issue was discovered in ingress-nginx where attacker-provided data are included in a filename by the ingress-nginx Admission Controller feature, resulting in directory traversal within the container. This coul...

PT-2025-12715

Name of the Vulnerable Software and Affected Versions Ingress-nginx versions prior to 1.12.1, from 1.12.0-beta.0 before 1.12.1 Description Ingress-nginx is vulnerable to a critical remote code execution RCE vulnerability CVE-2025-1974 with a CVSS score of 9.8. This flaw allows unauthenticated...

PT-2025-12716 · Unknown +1 · Ingress-Nginx +1

Name of the Vulnerable Software and Affected Versions: ingress-nginx versions prior to v1.12.1 ingress-nginx versions before v1.11.5 ingress-nginx versions from v1.12.0-beta.0 before v1.12.1 Description: A security issue was discovered in ingress-nginx where attacker-provided data are included in...

PT-2025-12713

Name of the Vulnerable Software and Affected Versions ingress-nginx versions prior to 1.11.5 ingress-nginx versions 1.12.0-beta.0 through 1.12.0 Description A security issue exists where the auth-tls-match-cn Ingress annotation can be used to inject configuration into nginx. This may allow a remo...

PT-2025-12717

Name of the Vulnerable Software and Affected Versions ingress-nginx versions prior to v1.11.5 ingress-nginx versions from v1.12.0-beta.0 through v1.12.1 Description A security issue exists in ingress-nginx where the auth-url Ingress annotation can be exploited to inject configuration into nginx...

PT-2025-12714 · Unknown +1 · Ingress-Nginx +1

Name of the Vulnerable Software and Affected Versions: ingress-nginx versions prior to v1.11.5 ingress-nginx versions from v1.12.0-beta.0 through v1.12.1 Description: A security issue was discovered in ingress-nginx where the mirror-target and mirror-host Ingress annotations can be used to inject...

AZL-59193 CVE-2025-30204 affecting package application-gateway-kubernetes-ingress for versions less than 1.7.7-2

golang-jwt is a Go implementation of JSON Web Tokens. Starting in version 3.2.0 and prior to versions 5.2.2 and 4.5.2, the function parse.ParseUnverified splits via a call to strings.Split its argument which is untrusted data on periods. As a result, in the face of a malicious request whose...

AZL-77490 CVE-2025-30204 affecting package application-gateway-kubernetes-ingress for versions less than 1.4.0-27

golang-jwt is a Go implementation of JSON Web Tokens. Starting in version 3.2.0 and prior to versions 5.2.2 and 4.5.2, the function parse.ParseUnverified splits via a call to strings.Split its argument which is untrusted data on periods. As a result, in the face of a malicious request whose...

kernel: net/sched: act_mirred: use the backlog for mirred ingress

A potential deadlock flaw was found in net/sched/actmirred.c in the Linux kernel. This may lead to compromised Availability...

Linux Distros Unpatched Vulnerability : CVE-2022-24687

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - HashiCorp Consul and Consul Enterprise 1.9.0 through 1.9.14, 1.10.7, and 1.11.2 clusters with at least one Ingress Gateway allow a user with service:write to...

Linux Distros Unpatched Vulnerability : CVE-2024-41010

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: bpf: Fix too early release of tcxentry Pedro Pinto and later independently also Hyunwoo Kim...

CVE-2022-49207 bpf, sockmap: Fix memleak in sk_psock_queue_msg

In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: Fix memleak in skpsockqueuemsg If tcpbpfsendmsg is running during a tear down operation we may enqueue data on the ingress msg queue while tear down is trying to free it. sk1 redirect sk2 sk2 -------------------...

GHSA-2JWV-JMQ4-4J3R vulnerabilities

Vulnerabilities for packages: buildkitd, go-md2man, dynamic-localpv-provisioner, bom, fuse-overlayfs-snapshotter, vertical-pod-autoscaler, gitleaks, wave, grafana-operator, spegel, atlantis, src-fingerprint, conftest, falcosidekick, litestream, terraform-docs, kubernetes-dns-node-cache,...

GHSA-J6M3-GC37-6R6Q vulnerabilities

Vulnerabilities for packages: hubble-ui, controller-gen, kube-logging-operator, paranoia, velero, nodetaint, dex, runc, go-bindata, k3s, prometheus-beat-exporter, local-path-provisioner, vt-cli, vault-csi-provider, cue, actions-runner-controller, fuse-overlayfs-snapshotter, src-fingerprint,...

GHSA-5FQ7-4MXC-535H vulnerabilities

Vulnerabilities for packages: hubble-ui, trivy, skopeo, flux-notification-controller, zot, crossplane-provider-aws, dex, runc, prometheus-beat-exporter, vt-cli, fuse-overlayfs-snapshotter, policy-controller-fips, src-fingerprint, cass-operator-fips-no-pvc-delete, atlantis-fips, tfsec,...

CVE-2024-51744 affecting package application-gateway-kubernetes-ingress for versions less than 1.7.7-1

CVE-2024-51744 affecting package application-gateway-kubernetes-ingress for versions less than 1.7.7-1. An upgraded version of the package is available that resolves this issue...

CVE-2024-35255 affecting package application-gateway-kubernetes-ingress for versions less than 1.7.7-1

CVE-2024-35255 affecting package application-gateway-kubernetes-ingress for versions less than 1.7.7-1. An upgraded version of the package is available that resolves this issue...

CVE-2023-3978 affecting package application-gateway-kubernetes-ingress for versions less than 1.7.7-1

CVE-2023-3978 affecting package application-gateway-kubernetes-ingress for versions less than 1.7.7-1. An upgraded version of the package is available that resolves this issue...

CVE-2023-45288 affecting package application-gateway-kubernetes-ingress for versions less than 1.7.7-1

CVE-2023-45288 affecting package application-gateway-kubernetes-ingress for versions less than 1.7.7-1. An upgraded version of the package is available that resolves this issue...