CVE-2021-25745

The connected records confirm CVE-2021-25745 affects ingress-nginx in Kubernetes. A user who can create/update Ingress objects can abuse spec.rules[].http.paths[].path (in networking.k8s.io or extensions) to obtain the credentials of the ingress-nginx controller. In the default configuration, tha...

Ingress-nginx `path` can be pointed to service account token file

Issue Details A security issue was discovered in ingress-nginx where a user that can create or update ingress objects can use the spec.rules.http.paths.path field of an Ingress object in the networking.k8s.io or extensions API group to obtain the credentials of the ingress-nginx controller. In th...