Skip to content
CVE PROGRAM SOURCE RECORD7.6 High

CVE-2021-25742

Ingress-nginx custom snippets allows retrieval of ingress-nginx serviceaccount token and secrets across all namespaces

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
kubernetes

Description

A security issue was discovered in ingress-nginx where a user that can create or update ingress objects can use the custom snippets feature to obtain all secrets in the cluster.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Kubernetes Kubernetes ingress-nginx

  • unspecified to ≤ 0.49.0affected
  • next of 0.49.0 to < unspecifiedunknown
  • unspecified to ≤ 1.0.0affected
  • next of 1.0.0 to < unspecifiedunknown

References