Skip to content
CVE PROGRAM SOURCE RECORD8.8 High

CVE-2024-7646

A security issue was discovered in ingress-nginx where an actor with permission to create Ingress objects (in the `networking.k8s.io` or `extensions` API group) can bypass annotati

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
kubernetes

Description

A security issue was discovered in ingress-nginx where an actor with permission to create Ingress objects (in the `networking.k8s.io` or `extensions` API group) can bypass annotation validation to inject arbitrary commands and obtain the credentials of the ingress-nginx controller. In the default configuration, that credential has access to all secrets in the cluster.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Kubernetes ingress-nginx

Default version status: affected

  • 1.11.0 to < 1.11.2affected
  • 1.11.2unaffected
  • 1.10.4unaffected
  • 0 to < 1.10.4affected

References