Kubernetes: Ingress nginx annotation injection causes arbitrary command execution

A vulnerability was found where arbitrary commands could be executed on the Kubernetes cluster. Through annotation injection on the ingress resource, additional locations could be added to the nginx configuration, allowing commands to be passed and executed via the lua scripting engine on the...

CVE-2021-25746

creationtimestamp| type| source ---|---|--- 2022-05-06 07:22:17+00:00| seen| https://t.me/cibsecurity/42089 2025-04-23 21:32:11+00:00| seen| https://gist.github.com/JohnPeng47/5146feaf5e65230c9c09b4348ebe205b...

CVE-2021-25746

CVE-2021-25746 affects the ingress-nginx controller. A user who can create or update Ingress objects can read the controller’s credentials by manipulating .metadata.annotations in an Ingress (networking.k8s.io or extensions API group). In the default configuration, those credentials grant access ...

CVE-2021-25746

A flaw was found in the ingress-nginx controller. When a user creates or updates ingress objects, credentials of the ingress-nginx controller can be obtained by accessing .metadata.annotations...