Information Disclosure

github.com/kubernetes/ingress-nginx is vulnerable to information disclosure. An attacker can obtain the credentials of the ingress-nginx controller by creating or updating ingress objects through the spec.rules[].http.paths[].path field of an ingress object(in the networking.k8s.io or extensions API group) that credential has access to all secrets in the cluster when using the default configuration.