Improper Access Control

github.com/kubernetes/ingress-nginx is vulnerable to Improper Access Control. The vulnerability exists because the library does not adequately validate path types. Consequently, an attacker with the ability to create or update ingress objects can utilize directives to evade the sanitization of the spec.rules[].http.paths[].path field within an Ingress object, specifically in the networking.k8s.io or extensions API group. This loophole may enable the attacker to acquire the credentials of the ingress-nginx controller. In the default configuration, these credentials grant access to all secrets in the cluster.