Kubernetes Ingress Nginx vulnerabilities

4 vulnerabilities

Known vulnerabilities in Kubernetes Ingress Nginx, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.

7.6CVE-2021-25742kubernetesingress-nginx+3
EPSS score
2.07%
A security issue was discovered in ingress-nginx where a user that can create or update ingress objects can use the custom snippets feature to obtain all secrets in the cluster.7.6CVE-2021-25746kubernetesingress-nginx+1
EPSS score
1.44%
A security issue was discovered in ingress-nginx where a user that can create or update ingress objects can use .metadata.annotations in an Ingress object (in the networking.k8s.io or extensions API group) to obtain the credentials of the ingress-nginx controller. In the default configuration, that credential has access to all secrets in the cluster.8.1CVE-2021-25745k8s.ioingress-nginx+3
EPSS score
1.18%
A security issue was discovered in ingress-nginx where a user that can create or update ingress objects can use the spec.rules[].http.paths[].path field of an Ingress object (in the networking.k8s.io or extensions API group) to obtain the credentials of the ingress-nginx controller. In the default configuration, that credential has access to all secrets in the cluster.7.6CVE-2021-25748k8s.ioingress-nginx+2
EPSS score
0.69%
A security issue was discovered in ingress-nginx where a user that can create or update ingress objects can use a newline character to bypass the sanitization of the `spec.rules[].http.paths[].path` field of an Ingress object (in the `networking.k8s.io` or `extensions` API group) to obtain the credentials of the ingress-nginx controller. In the default configuration, that credential has access to all secrets in the cluster.