Improper Input Validation

k8s.io/ingress-nginx is vulnerable to Improper Input Validation. The vulnerability is caused by a missing validation check on nginx.ingress.kubernetes.io/configuration-snippet annotation on an Ingress object (in the networking.k8s.io or extensions API group). The above annotation can be used to inject arbitrary commands and obtain the credentials of the ingress-nginx controller which in default configuration, has access to all secrets in the cluster. This vulnerability is only applicable if ingress-nginx controller is installed on the cluster. The high severity is not applicable when chrooted ingress-nginx controller introduced in v1.2.0 is running in the cluster because command execution is possible but credentials extraction is not.